CVE-2025-62365 - LibreNMS vulnerable to Reflected-XSS in `report_this` function

Back Back to CVE browser

MEDIUM

LibreNMS vulnerable to Reflected-XSS in `report_this` function

Published Oct 13, 2025

5.5

MEDIUM

CVSS 4.0

EPSS 0.25%

Description

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to 25.7.0, there is a reflected-XSS in `report_this` function in `librenms/includes/functions.php`. The `report_this` function had improper filtering (`htmlentities` function was incorrectly use in a href environment), which caused the `project_issues` parameter to trigger an XSS vulnerability. This vulnerability is fixed in 25.7.0.

Affected products

Vendor Librenms Product Librenms Default
n/a
- Version
  < 25.7.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Librenms

n/a

Version	Status	Constraints
< 25.7.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34114
Advisory
https://github.com/advisories/GHSA-86rg-8hc8-v82p
Advisory
https://github.com/librenms/librenms/commit/30d3dd7e5f5e22a8c23c9db3ad90a731c005b008
x_refsource_MISCPatch
https://github.com/librenms/librenms/security/advisories/GHSA-86rg-8hc8-v82p
x_refsource_CONFIRMExploitVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-62365

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34114		Advisory
https://github.com/advisories/GHSA-86rg-8hc8-v82p		Advisory
https://github.com/librenms/librenms/commit/30d3dd7e5f5e22a8c23c9db3ad90a731c005b008		x_refsource_MISCPatch
https://github.com/librenms/librenms/security/advisories/GHSA-86rg-8hc8-v82p		x_refsource_CONFIRMExploitVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-62365