CVE-2025-23200: medium-severity vulnerability in librenms
Stored XSS-LibreNMS-Misc Section in librenms
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
LibreNMS versions before 24.11.0 contain a stored XSS vulnerability in the ajax_form.php file's state parameter. An attacker can inject malicious scripts that execute when other users view the affected page, potentially allowing unauthorized actions or data theft.
Stored cross-site scripting (CWE-79) exists in the state parameter of ajax_form.php, allowing unauthenticated or authenticated remote attackers to inject persistent malicious scripts into the application. When users interact with pages containing the stored payload, the script executes in their browser context, potentially enabling session hijacking, credential theft, or unauthorized administrative actions.
In the same product, most dangerous first.