CVE-2025-65013

MEDIUM

LibreNMS < 25.11.0 - Reflected Cross-Site Scripting via Image Name Parameter

Title source: llm
STIX 2.1

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting (XSS) vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response without proper output encoding or sanitization, allowing an attacker to craft a URL that, when visited by a victim, causes arbitrary JavaScript execution in the victim’s browser. This issue has been patched in version 25.11.0.

References (1)

Core 1
Core References

Scores

CVSS v3 6.2
EPSS 0.0022
EPSS Percentile 11.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
librenms/librenms < 25.11.0
librenms/librenms 0 - 25.11.0Packagist
Published Nov 18, 2025
Tracked Since Feb 18, 2026