CVE-2025-23201

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting XSS on the parameters:/addhost - param: community. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with th...

CVE-2022-0772

Cross-site Scripting XSS - Stored in GitHub repository librenms/librenms prior to 22.2.2...

CVE-2022-0589

Cross-site Scripting XSS - Stored in Packagist librenms/librenms prior to 22.1.0...

CVE-2023-4978

Cross-site Scripting XSS - DOM in GitHub repository librenms/librenms prior to 23.9.0...

CVE-2023-4981

Cross-site Scripting XSS - DOM in GitHub repository librenms/librenms prior to 23.9.0...

CVE-2023-4347

Cross-site Scripting XSS - Reflected in GitHub repository librenms/librenms prior to 23.8.0...

CVE-2023-4982

Cross-site Scripting XSS - Stored in GitHub repository librenms/librenms prior to 23.9.0...

CVE-2023-4977

Code Injection in GitHub repository librenms/librenms prior to 23.9.0...

CVE-2023-4980

Cross-site Scripting XSS - Generic in GitHub repository librenms/librenms prior to 23.9.0...

CVE-2023-4979

Cross-site Scripting XSS - Reflected in GitHub repository librenms/librenms prior to 23.9.0...

CVE-2022-0580

Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0...

CVE-2022-0587

Improper Authorization in Packagist librenms/librenms prior to 22.2.0...

CVE-2019-12464

An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter, to cause local file inclusion resulting in code execution...

CVE-2019-12465

An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajaxrulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajaxrulesuggest.php?debug=1= request...

CVE-2019-12463

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...

CVE-2025-68614

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.12.0, the Alert Rule API is vulnerable to stored cross-site scripting. Alert rules can be created or updated via LibreNMS API. The alert rule name is not properly sanitized, and can be used to inject...

EUVD-2025-204770

LibreNMS Alert Rule API Cross-Site Scripting Vulnerability...

LibreNMS Alert Rule API Cross-Site Scripting Vulnerability

Please find POC file here https://trendmicro-my.sharepoint.com/:u:/p/kholoudaltookhy/IQCfcnOE5ykQSb6Fm-HFI872AZzeIJxU-3aDk0jheXNE?e=zkN76d ZDI-CAN-28575: LibreNMS Alert Rule API Cross-Site Scripting Vulnerability -- CVSS ----------------------------------------- 4.3:...

GHSA-C89F-8G7G-59WJ LibreNMS Alert Rule API Cross-Site Scripting Vulnerability

Please find POC file here https://trendmicro-my.sharepoint.com/:u:/p/kholoudaltookhy/IQCfcnOE5ykQSb6Fm-HFI872AZzeIJxU-3aDk0jheXNE?e=zkN76d ZDI-CAN-28575: LibreNMS Alert Rule API Cross-Site Scripting Vulnerability -- CVSS ----------------------------------------- 4.3:...

CVE-2025-68614

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.12.0, the Alert Rule API is vulnerable to stored cross-site scripting. Alert rules can be created or updated via LibreNMS API. The alert rule name is not properly sanitized, and can be used to inject...