VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Oct 13, 2025· Updated Oct 14, 2025

LibreNMS vulnerable to Reflected-XSS in `report_this` function

CVE-2025-62365

Description

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to 25.7.0, there is a reflected-XSS in report_this function in librenms/includes/functions.php. The report_this function had improper filtering (htmlentities function was incorrectly use in a href environment), which caused the project_issues parameter to trigger an XSS vulnerability. This vulnerability is fixed in 25.7.0.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
librenms/librenmsPackagist
< 25.7.025.7.0

Affected products

1

Patches

1
30d3dd7e5f5e

Remove report_this function (#17941)

https://github.com/librenms/librenmsTony MurrayJun 25, 2025via ghsa
commit
6 files changed · +5 −10
  • includes/functions.php+0 −5 modified
    @@ -439,11 +439,6 @@ function delta_to_bits($delta, $period)
     return round($delta * 8 / $period, 2);
 }
 
-function report_this($message)
-{
-    return '<h2>' . htmlentities($message) . ' Please <a href="' . htmlentities(Config::get('project_issues')) . '">report this</a> to the ' . htmlentities(Config::get('project_name')) . ' developers.</h2>';
-}//end report_this()
-
 function hytera_h2f($number, $nd)
 {
     if (strlen(str_replace(' ', '', $number)) == 4) {
  • includes/html/pages/device/alerts.inc.php+1 −1 modified
    @@ -64,7 +64,7 @@
 
     default:
         echo '</div>';
-        echo report_this('Unknown section ' . $vars['section']);
+        echo 'Unknown section';
         break;
 }
  • includes/html/pages/device/logs.inc.php+1 −1 modified
    @@ -91,7 +91,7 @@
 
     default:
         echo '</div>';
-        echo report_this('Unknown section ' . $vars['section']);
+        echo 'Unknown section';
         break;
 }
  • includes/html/pages/routing.inc.php+1 −1 modified
    @@ -76,6 +76,6 @@
         break;
 
     default:
-        echo report_this('Unknown protocol ' . $vars['protocol']);
+        echo 'Unknown protocol';
         break;
 }
  • includes/html/pages/search.inc.php+1 −1 modified
    @@ -44,5 +44,5 @@
 if (file_exists("includes/html/pages/search/$search_type.inc.php")) {
     include "includes/html/pages/search/$search_type.inc.php";
 } else {
-    echo report_this('Unknown search type ' . htmlspecialchars($search_type));
+    echo 'Unknown search type';
 }
  • includes/html/pages/tools.inc.php+1 −1 modified
    @@ -36,5 +36,5 @@
 if (file_exists("includes/html/pages/tools/$tools_type.inc.php")) {
     include "includes/html/pages/tools/$tools_type.inc.php";
 } else {
-    echo report_this("Unknown tool type $tools_type");
+    echo 'Unknown tool type';
 }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.