CVE-2025-47931 - Vulnerability Details

Vendors	Products
Librenms	Librenms

Link	Providers
https://github.com/librenms/librenms/blob/25.4.0/includes/html/pages/addhost.inc.php#L284
https://github.com/librenms/librenms/commit/88fe1a7abdb500d9a2d4c45f9872df54c9ff8062
https://github.com/librenms/librenms/pull/17603
https://github.com/librenms/librenms/security/advisories/GHSA-hxw5-9cc5-cmw5

Type	Values Removed	Values Added
First Time appeared		Librenms Librenms librenms
CPEs		cpe:2.3:a:librenms:librenms::::::::
Vendors & Products		Librenms Librenms librenms
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) Vulnerability in the `group name` parameter of the `http://localhost/poller/groups` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. LibreNMS v25.5.0 contains a patch for the issue.
Title		LibreNMS stored Cross-site Scripting vulnerability in poller group name
Weaknesses		CWE-79
References		https://github.com/librenms/librenms/blob/25.4.0/includes/html/pages/addhost.inc.php#L284 https://github.com/librenms/librenms/commit/88fe1a7abdb500d9a2d4c45f9872df54c9ff8062 https://github.com/librenms/librenms/pull/17603 https://github.com/librenms/librenms/security/advisories/GHSA-hxw5-9cc5-cmw5
Metrics		cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-47931", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-05-14T10:32:43.529Z", "datePublished": "2025-05-17T15:51:17.277Z", "dateUpdated": "2025-05-19T20:17:46.155Z"}, "containers": {"cna": {"title": "LibreNMS stored Cross-site Scripting vulnerability in poller group name", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/librenms/librenms/security/advisories/GHSA-hxw5-9cc5-cmw5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/librenms/librenms/security/advisories/GHSA-hxw5-9cc5-cmw5"}, {"name": "https://github.com/librenms/librenms/pull/17603", "tags": ["x_refsource_MISC"], "url": "https://github.com/librenms/librenms/pull/17603"}, {"name": "https://github.com/librenms/librenms/commit/88fe1a7abdb500d9a2d4c45f9872df54c9ff8062", "tags": ["x_refsource_MISC"], "url": "https://github.com/librenms/librenms/commit/88fe1a7abdb500d9a2d4c45f9872df54c9ff8062"}, {"name": "https://github.com/librenms/librenms/blob/25.4.0/includes/html/pages/addhost.inc.php#L284", "tags": ["x_refsource_MISC"], "url": "https://github.com/librenms/librenms/blob/25.4.0/includes/html/pages/addhost.inc.php#L284"}], "affected": [{"vendor": "librenms", "product": "librenms", "versions": [{"version": "< 25.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-05-17T15:51:17.277Z"}, "descriptions": [{"lang": "en", "value": "LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) Vulnerability in the `group name` parameter of the `http://localhost/poller/groups` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. LibreNMS v25.5.0 contains a patch for the issue."}], "source": {"advisory": "GHSA-hxw5-9cc5-cmw5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-19T20:17:23.106785Z", "id": "CVE-2025-47931", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-19T20:17:46.155Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2025-47931 (string)

assignerOrgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

state : PUBLISHED (string)

assignerShortName : GitHub_M (string)

dateReserved : 2025-05-14T10:32:43.529Z (string)

datePublished : 2025-05-17T15:51:17.277Z (string)

dateUpdated : 2025-05-19T20:17:46.155Z (string)

}

containers : { »

cna : { »

title : LibreNMS stored Cross-site Scripting vulnerability in poller group name (string)

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-79 (string)

lang : en (string)

description : CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (string)

type : CWE (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV4_0 : { »

attackVector : NETWORK (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

privilegesRequired : NONE (string)

userInteraction : PASSIVE (string)

vulnConfidentialityImpact : NONE (string)

vulnIntegrityImpact : NONE (string)

vulnAvailabilityImpact : NONE (string)

subConfidentialityImpact : LOW (string)

subIntegrityImpact : LOW (string)

subAvailabilityImpact : NONE (string)

baseScore : 2.1 (number)

baseSeverity : LOW (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P (string)

version : 4.0 (string)

}

]

references : [ »

0 : { »

name : https://github.com/librenms/librenms/security/advisories/GHSA-hxw5-9cc5-cmw5 (string)

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://github.com/librenms/librenms/security/advisories/GHSA-hxw5-9cc5-cmw5 (string)

}

1 : { »

name : https://github.com/librenms/librenms/pull/17603 (string)

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://github.com/librenms/librenms/pull/17603 (string)

}

2 : { »

name : https://github.com/librenms/librenms/commit/88fe1a7abdb500d9a2d4c45f9872df54c9ff8062 (string)

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://github.com/librenms/librenms/commit/88fe1a7abdb500d9a2d4c45f9872df54c9ff8062 (string)

}

3 : { »

name : https://github.com/librenms/librenms/blob/25.4.0/includes/html/pages/addhost.inc.php#L284 (string)

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://github.com/librenms/librenms/blob/25.4.0/includes/html/pages/addhost.inc.php#L284 (string)

}

]

affected : [ »

0 : { »

vendor : librenms (string)

product : librenms (string)

versions : [ »

0 : { »

version : < 25.5.0 (string)

status : affected (string)

}

]

}

]

providerMetadata : { »

orgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

shortName : GitHub_M (string)

dateUpdated : 2025-05-17T15:51:17.277Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) Vulnerability in the `group name` parameter of the `http://localhost/poller/groups` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. LibreNMS v25.5.0 contains a patch for the issue. (string)

}

]

source : { »

advisory : GHSA-hxw5-9cc5-cmw5 (string)

discovery : UNKNOWN (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-05-19T20:17:23.106785Z (string)

id : CVE-2025-47931 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-05-19T20:17:46.155Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-47931", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-19T20:17:23.106785Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-19T20:17:40.464Z"}}], "cna": {"title": "LibreNMS stored Cross-site Scripting vulnerability in poller group name", "source": {"advisory": "GHSA-hxw5-9cc5-cmw5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "librenms", "product": "librenms", "versions": [{"status": "affected", "version": "< 25.5.0"}]}], "references": [{"url": "https://github.com/librenms/librenms/security/advisories/GHSA-hxw5-9cc5-cmw5", "name": "https://github.com/librenms/librenms/security/advisories/GHSA-hxw5-9cc5-cmw5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/librenms/librenms/pull/17603", "name": "https://github.com/librenms/librenms/pull/17603", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/librenms/librenms/commit/88fe1a7abdb500d9a2d4c45f9872df54c9ff8062", "name": "https://github.com/librenms/librenms/commit/88fe1a7abdb500d9a2d4c45f9872df54c9ff8062", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/librenms/librenms/blob/25.4.0/includes/html/pages/addhost.inc.php#L284", "name": "https://github.com/librenms/librenms/blob/25.4.0/includes/html/pages/addhost.inc.php#L284", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) Vulnerability in the `group name` parameter of the `http://localhost/poller/groups` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. LibreNMS v25.5.0 contains a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-05-17T15:51:17.277Z"}}}, "cveMetadata": {"cveId": "CVE-2025-47931", "state": "PUBLISHED", "dateUpdated": "2025-05-19T20:17:46.155Z", "dateReserved": "2025-05-14T10:32:43.529Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-05-17T15:51:17.277Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2025-47931 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-05-19T20:17:23.106785Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-05-19T20:17:40.464Z (string)

}

]

cna : { »

title : LibreNMS stored Cross-site Scripting vulnerability in poller group name (string)

source : { »

advisory : GHSA-hxw5-9cc5-cmw5 (string)

discovery : UNKNOWN (string)

}

metrics : [ »

0 : { »

cvssV4_0 : { »

version : 4.0 (string)

baseScore : 2.1 (number)

attackVector : NETWORK (string)

baseSeverity : LOW (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P (string)

userInteraction : PASSIVE (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

privilegesRequired : NONE (string)

subIntegrityImpact : LOW (string)

vulnIntegrityImpact : NONE (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : NONE (string)

subConfidentialityImpact : LOW (string)

vulnConfidentialityImpact : NONE (string)

}

]

affected : [ »

0 : { »

vendor : librenms (string)

product : librenms (string)

versions : [ »

0 : { »

status : affected (string)

version : < 25.5.0 (string)

}

]

}

]

references : [ »

0 : { »

url : https://github.com/librenms/librenms/security/advisories/GHSA-hxw5-9cc5-cmw5 (string)

name : https://github.com/librenms/librenms/security/advisories/GHSA-hxw5-9cc5-cmw5 (string)

tags : [ »

0 : x_refsource_CONFIRM (string)

]

}

1 : { »

url : https://github.com/librenms/librenms/pull/17603 (string)

name : https://github.com/librenms/librenms/pull/17603 (string)

tags : [ »

0 : x_refsource_MISC (string)

]

}

2 : { »

url : https://github.com/librenms/librenms/commit/88fe1a7abdb500d9a2d4c45f9872df54c9ff8062 (string)

name : https://github.com/librenms/librenms/commit/88fe1a7abdb500d9a2d4c45f9872df54c9ff8062 (string)

tags : [ »

0 : x_refsource_MISC (string)

]

}

3 : { »

url : https://github.com/librenms/librenms/blob/25.4.0/includes/html/pages/addhost.inc.php#L284 (string)

name : https://github.com/librenms/librenms/blob/25.4.0/includes/html/pages/addhost.inc.php#L284 (string)

tags : [ »

0 : x_refsource_MISC (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) Vulnerability in the `group name` parameter of the `http://localhost/poller/groups` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. LibreNMS v25.5.0 contains a patch for the issue. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-79 (string)

description : CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (string)

}

]

}

]

providerMetadata : { »

orgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

shortName : GitHub_M (string)

dateUpdated : 2025-05-17T15:51:17.277Z (string)

}

cveMetadata : { »

cveId : CVE-2025-47931 (string)

state : PUBLISHED (string)

dateUpdated : 2025-05-19T20:17:46.155Z (string)

dateReserved : 2025-05-14T10:32:43.529Z (string)

assignerOrgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

datePublished : 2025-05-17T15:51:17.277Z (string)

assignerShortName : GitHub_M (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*", "matchCriteriaId": "B732DD5B-2BE1-40B9-BA40-7B6786B483DB", "versionEndExcluding": "25.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) Vulnerability in the `group name` parameter of the `http://localhost/poller/groups` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. LibreNMS v25.5.0 contains a patch for the issue."}, {"lang": "es", "value": "LibreNMS es un software de monitorizaci\u00f3n de red basado en PHP/MySQL/SNMP. LibreNMS v25.4.0 y versiones anteriores presenta una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en el par\u00e1metro `group name` del formato `http://localhost/poller/groups`. Esta vulnerabilidad permite a los atacantes inyectar scripts maliciosos en p\u00e1ginas web visitadas por otros usuarios. LibreNMS v25.5.0 incluye un parche para solucionar este problema."}], "id": "CVE-2025-47931", "lastModified": "2025-05-28T13:19:14.460", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2025-05-17T16:15:19.253", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/librenms/librenms/blob/25.4.0/includes/html/pages/addhost.inc.php#L284"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/librenms/librenms/commit/88fe1a7abdb500d9a2d4c45f9872df54c9ff8062"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/librenms/librenms/pull/17603"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/librenms/librenms/security/advisories/GHSA-hxw5-9cc5-cmw5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:* (string)

matchCriteriaId : B732DD5B-2BE1-40B9-BA40-7B6786B483DB (string)

versionEndExcluding : 25.5.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) Vulnerability in the `group name` parameter of the `http://localhost/poller/groups` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. LibreNMS v25.5.0 contains a patch for the issue. (string)

}

1 : { »

lang : es (string)

value : LibreNMS es un software de monitorización de red basado en PHP/MySQL/SNMP. LibreNMS v25.4.0 y versiones anteriores presenta una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en el parámetro `group name` del formato `http://localhost/poller/groups`. Esta vulnerabilidad permite a los atacantes inyectar scripts maliciosos en páginas web visitadas por otros usuarios. LibreNMS v25.5.0 incluye un parche para solucionar este problema. (string)

}

]

id : CVE-2025-47931 (string)

lastModified : 2025-05-28T13:19:14.460 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

cvssMetricV40 : [ »

0 : { »

cvssData : { »

Automatable : NOT_DEFINED (string)

Recovery : NOT_DEFINED (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

availabilityRequirement : NOT_DEFINED (string)

baseScore : 2.1 (number)

baseSeverity : LOW (string)

confidentialityRequirement : NOT_DEFINED (string)

exploitMaturity : PROOF_OF_CONCEPT (string)

integrityRequirement : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubAvailabilityImpact : NOT_DEFINED (string)

modifiedSubConfidentialityImpact : NOT_DEFINED (string)

modifiedSubIntegrityImpact : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnAvailabilityImpact : NOT_DEFINED (string)

modifiedVulnConfidentialityImpact : NOT_DEFINED (string)

modifiedVulnIntegrityImpact : NOT_DEFINED (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : LOW (string)

subIntegrityImpact : LOW (string)

userInteraction : PASSIVE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (string)

version : 4.0 (string)

vulnAvailabilityImpact : NONE (string)

vulnConfidentialityImpact : NONE (string)

vulnIntegrityImpact : NONE (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

source : security-advisories@github.com (string)

type : Secondary (string)

}

]

}

published : 2025-05-17T16:15:19.253 (string)

references : [ »

0 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Product (string)

]

url : https://github.com/librenms/librenms/blob/25.4.0/includes/html/pages/addhost.inc.php#L284 (string)

}

1 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Patch (string)

]

url : https://github.com/librenms/librenms/commit/88fe1a7abdb500d9a2d4c45f9872df54c9ff8062 (string)

}

2 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Issue Tracking (string)

1 : Patch (string)

]

url : https://github.com/librenms/librenms/pull/17603 (string)

}

3 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Exploit (string)

1 : Vendor Advisory (string)

]

url : https://github.com/librenms/librenms/security/advisories/GHSA-hxw5-9cc5-cmw5 (string)

}

]

sourceIdentifier : security-advisories@github.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : security-advisories@github.com (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object