LibreNMS allows stored XSS in Alert Template name field

Summary A stored Cross-Site Scripting XSS vulnerability exists in LibreNMS alertdocument.cookie/script and filling the other fields with arbitrary content e.g., test, once the template is saved, the script is executed. This confirms that user input is stored and later rendered without proper outp...

GHSA-VXQ6-8CWM-WJ99 LibreNMS allows stored XSS in Alert Template name field

Summary A stored Cross-Site Scripting XSS vulnerability exists in LibreNMS alertdocument.cookie/script and filling the other fields with arbitrary content e.g., test, once the template is saved, the script is executed. This confirms that user input is stored and later rendered without proper outp...

CVE-2025-55296

librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting XSS vulnerability exists in LibreNMS = 25.6.0 in the Alert Template creation feature. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the template...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Alert Template name field. An attacker can execute arbitrary JavaScript in the conte...

CVE-2025-55296

LibreNMS (LibreNMS) has a stored XSS in the Alert Template name field affecting versions up to and including 25.6.0. The vulnerability requires an admin to inject JavaScript that executes when the template renders, potentially compromising other admin accounts. Remediation is to upgrade to versio...

CVE-2025-55296 LibreNMS allows stored XSS in Alert Template name field

librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting XSS vulnerability exists in LibreNMS = 25.6.0 in the Alert Template creation feature. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the template...

CVE-2025-55296 LibreNMS allows stored XSS in Alert Template name field

librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting XSS vulnerability exists in LibreNMS = 25.6.0 in the Alert Template creation feature. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the template...

CVE-2025-55296 LibreNMS allows stored XSS in Alert Template name field

librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting XSS vulnerability exists in LibreNMS = 25.6.0 in the Alert Template creation feature. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the template...

PT-2025-33678 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: librenms versions prior to 25.8.0 Description: A stored Cross-Site Scripting XSS issue exists in LibreNMS in the Alert Template creation feature. This allows a user with admin privileges to inject malicious JavaScript, which will be executed...

LibreNMS 跨站脚本漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments, and automatic updates. A cross-site scripting vulnerability exists in LibreNMS 25.6.0 and earlier versions, whi...

CVE-2025-54138

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajaxform.php endpoint that permits Remote File Inclusion base...

CVE-2025-54138

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajaxform.php endpoint that permits Remote File Inclusion base...

CVE-2025-54138 LibreNMS has Authenticated Local File Inclusion in ajax_form.php that Allows RCE

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajaxform.php endpoint that permits Remote File Inclusion base...

CVE-2025-54138 LibreNMS has Authenticated Local File Inclusion in ajax_form.php that Allows RCE

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajaxform.php endpoint that permits Remote File Inclusion base...

CVE-2025-54138

CVE-2025-54138 affects LibreNMS 25.6.0 and earlier. The vulnerability is an architectural Remote File Inclusion in the ajax_form.php endpoint: user-controlled POST input (type) causes inclusion of includes/html/forms/{type}.inc.php, enabling a potential Remote Code Execution if an attacker can st...

CVE-2025-54138 LibreNMS has Authenticated Local File Inclusion in ajax_form.php that Allows RCE

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajaxform.php endpoint that permits Remote File Inclusion base...

LibreNMS 安全漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments, and automatic updates. A security vulnerability exists in LibreNMS 25.6.0 and prior versions, which stems from...

PHP Remote File Inclusion

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to PHP Remote File Inclusion via the ajaxform.php process. An attacker can execute arbitrary code on the server by...

LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE

LibreNMS 25.6.0 contains an architectural vulnerability in the ajaxform.php endpoint that permits Remote File Inclusion based on user-controlled POST input. The application directly uses the type parameter to dynamically include .inc.php files from the trusted path includes/html/forms/, without...

GHSA-GQ96-8W38-HHJ2 LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE

LibreNMS 25.6.0 contains an architectural vulnerability in the ajaxform.php endpoint that permits Remote File Inclusion based on user-controlled POST input. The application directly uses the type parameter to dynamically include .inc.php files from the trusted path includes/html/forms/, without...