CVE-2025-68614: medium-severity vulnerability in librenms
LibreNMS Alert Rule API Cross-Site Scripting Vulnerability
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
LibreNMS allows attackers to inject malicious code into alert rule names through its API, which can execute in other users' browsers when they view the alert rules. This could let attackers steal sensitive information or perform actions on behalf of legitimate users.
Stored XSS vulnerability in LibreNMS Alert Rule API where unsanitized alert rule names permit HTML/JavaScript injection. Attack vector is API-based (pre-condition: API access), with persistence across sessions. Impact includes session hijacking, credential theft, and unauthorized administrative actions for users accessing stored alert rules.
In the same product, most dangerous first.