VulnerabilityAnalyzed

CVE-2025-65013

Prior to version 25.11.0, a reflected cross-site scripting (XSS) vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint.

MEDIUM 6.1EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting (XSS) vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response without proper output encoding or sanitization, allowing an attacker to craft a URL that, when visited by a victim, causes arbitrary JavaScript execution in the victim’s browser. This issue has been patched in version 25.11.0.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.25% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: librenms/librenms
Source: security-advisories@github.com

References

https://github.com/librenms/librenms/security/advisories/GHSA-j8cq-7f6p-256xVendor Advisory
https://github.com/librenms/librenms/security/advisories/GHSA-j8cq-7f6p-256xVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.