CVE-2025-65013: 
PHP Análisis y mitigación de vulnerabilidades

LibreNMS, an auto-discovering PHP/MySQL/SNMP based network monitoring tool, was found to contain a reflected cross-site scripting (XSS) vulnerability prior to version 25.11.0. The vulnerability was identified in the /maps/nodeimage endpoint where the Image Name parameter was not properly sanitized (LibreNMS Advisory).

The vulnerability exists in the /maps/nodeimage endpoint where the Image Name parameter is reflected in the HTTP response without proper output encoding or sanitization. When a user submits input through this parameter, it gets reflected back in the server response and is parsed as HTML/JavaScript by the browser. The vulnerability is tracked as CVE-2025-65013 and has been assigned a CVSS v3.1 score of 6.2 (Moderate) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N (LibreNMS Advisory).

The vulnerability can be exploited to execute arbitrary JavaScript in the context of any user who visits a crafted link. This could lead to session cookie theft, authentication token compromise, unauthorized actions performed on behalf of the victim, and potential phishing attacks through UI manipulation. The attacker could also exfiltrate sensitive information visible to the victim and potentially pivot to further attacks depending on application context and user privileges (LibreNMS Advisory).

The vulnerability has been patched in LibreNMS version 25.11.0. Users are advised to upgrade to this version or later to address the security issue (LibreNMS Advisory).