LibreNMS Alert Rule API Cross-Site Scripting Vulnerability

LibreNMS allows attackers to inject malicious code into alert rule names through its API, which can execute in other users' browsers when they view the alert rules. This could let attackers steal sensitive information or perform actions on behalf of legitimate users.

Stored XSS vulnerability in LibreNMS Alert Rule API where unsanitized alert rule names permit HTML/JavaScript injection. Attack vector is API-based (pre-condition: API access), with persistence across sessions. Impact includes session hijacking, credential theft, and unauthorized administrative actions for users accessing stored alert rules.