https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 07:48:42 +0000 https://db.gcve.eu/vuln/fkie_cve-2025-62365 <p>LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to 25.7.0, there is a reflected-XSS in `report_this` function in `librenms/includes/functions.php`. The `report_this` function had improper filtering (`htmlentities` function was incorrectly use in a href environment), which caused the `project_issues` parameter to trigger an XSS vulnerability. This vulnerability is fixed in 25.7.0.</p> <p>LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to 25.7.0, there is a reflected-XSS in `report_this` function in `librenms/includes/functions.php`. The `report_this` function had improper filtering (`htmlentities` function was incorrectly use in a href environment), which caused the `project_issues` parameter to trigger an XSS vulnerability. This vulnerability is fixed in 25.7.0.</p> https://db.gcve.eu/vuln/fkie_cve-2025-62365 https://db.gcve.eu/vuln/ghsa-86rg-8hc8-v82p <p><strong>Affected:</strong> Packagist: librenms/librenms</p> <p>### Summary Reflected-XSS in `report_this` function in `librenms/includes/functions.php`</p> <p>### Details Recently, it was discovered that the `report_this` function had improper filtering (`htmlentities` function was incorrectly used in a href environment), which caused the `project_issues` parameter to trigger an XSS vulnerability.</p> <p>The Vulnerable Sink: https://github.com/librenms/librenms/blob/master/includes/functions.php#L444</p> <p>### PoC GET `project_issues=javascript:alert(document.cookie)`</p> <p>### Impact XSS vulnerabilities allow attackers to execute malicious scripts in users&#39; browsers, enabling unauthorized access to sensitive data, session hijacking, or malware distribution.</p> <p>### Suggestion It is recommended to filter dangerous protocols, e.g. `javascript:`/`file:`.</p> <p><strong>Affected:</strong> Packagist: librenms/librenms</p> <p>### Summary Reflected-XSS in `report_this` function in `librenms/includes/functions.php`</p> <p>### Details Recently, it was discovered that the `report_this` function had improper filtering (`htmlentities` function was incorrectly used in a href environment), which caused the `project_issues` parameter to trigger an XSS vulnerability.</p> <p>The Vulnerable Sink: https://github.com/librenms/librenms/blob/master/includes/functions.php#L444</p> <p>### PoC GET `project_issues=javascript:alert(document.cookie)`</p> <p>### Impact XSS vulnerabilities allow attackers to execute malicious scripts in users&#39; browsers, enabling unauthorized access to sensitive data, session hijacking, or malware distribution.</p> <p>### Suggestion It is recommended to filter dangerous protocols, e.g. `javascript:`/`file:`.</p> https://db.gcve.eu/vuln/ghsa-86rg-8hc8-v82p