HTML Injection Vulnerability in LibreNMS Network Monitoring System
CVE-2025-62412

3.8LOW

Key Information:

Vendor

Librenms

Status
Librenms
Vendor
CVE Published:
16 October 2025

What is CVE-2025-62412?

An HTML injection vulnerability exists in the LibreNMS network monitoring system, which is a community-supported tool licensed under the GPL. This flaw occurs in the Alerts > Alert Rules page where the alert rule name is not adequately sanitized, allowing an attacker to inject malicious HTML code. The issue has been rectified in version 25.10.0, highlighting the importance of updating to secure installations against potential attacks.

Affected Version(s)

librenms < 25.10.0

References

https://github.com/librenms/librenms/security/advisories/...
x_refsource_CONFIRM
https://github.com/librenms/librenms/commit/dccdf6769976a...
x_refsource_MISC

CVSS V3.1

Score:
3.8
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.