PT-2025-41825 · Librenms · Librenms

Gatekeeperbuster · Published 2025-10-13 · Updated 2025-10-20 · CVE-2025-62365

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 25.7.0

Description LibreNMS, an open-source network monitoring system, contains a reflected cross-site scripting (XSS) issue. The report this function within librenms/includes/functions.php exhibits improper filtering of the project issues parameter when using the htmlentities function in an anchor environment. This allows for the execution of malicious scripts. The vulnerable function is report this.

Recommendations Upgrade to LibreNMS version 25.7.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62365

GHSA-86RG-8HC8-V82P

Affected Products

Librenms

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62365.json · Exploit
• https://github.com/librenms/librenms/security/advisories/GHSA-86rg-8hc8-v82p · Vendor Advisory
• https://github.com/librenms/librenms/commit/30d3dd7e5f5e22a8c23c9db3ad90a731c005b008 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-62365 · Security Note
• https://osv.dev/vulnerability/GHSA-86rg-8hc8-v82p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62365 · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://twitter.com/VulmonFeeds/status/1977903006050844930 · Twitter Post
• https://t.me/CVEtracker/34806 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1o7bmsg/resumen_diario_de_vulnerabilidades_15102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1o87w9u/resumen_diario_de_vulnerabilidades_16102025 · Reddit Post
• https://twitter.com/CVEnew/status/1977854470727115088 · Twitter Post
• https://t.me/cveNotify/139473 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1o6h2pg/resumen_diario_de_vulnerabilidades_14102025 · Reddit Post