LibreNMS CVE-2025-62411

Requires an administrator account to create or edit an Alert Transport (the injection point is the Transport name field at /alert-transports), and the payload only fires when an administrator subsequently views the Alert Rules page at /alert-rules. Per the vendor advisory, only admins can create transports and only admins can view the affected page, so both exploitation and impact are confined to the administrator role - this is the primary limiting factor. There is no anonymous or low-privilege path; realistic abuse requires either a rogue admin, a compromised admin account, or tricking an admin into saving a crafted transport name. Affected: LibreNMS <= 25.8.0; fixed in 25.10.0.

This is a stored XSS (CWE-79) with a modest CVSS 3.1 base score of 4.8, and the vector itself is the dominant risk-limiting signal: AV:N but PR:H (administrator required to inject) and UI:R (an admin must then load the Alert Rules page). The GHSA advisory explicitly confirms that both the injection point (/alert-transports) and the execution point (/alert-rules) are restricted to administrators, so this is effectively an admin-to-admin (or self-) XSS rather than a privilege-escalation-from-anonymous path. The strongest countervailing signal is EPSS: 12.72% at the 96th percentile is unusually high for a low-CVSS XSS and indicates meaningful real-world exploitation probability - but EPSS reflects general exploitation likelihood and should not be over-read here given the hard PR:H precondition. This vulnerability is NOT CISA KEV-listed, so there is no confirmed active exploitation; the high EPSS plus public POC suggests opportunistic interest rather than observed campaigns. Net assessment: a genuine but lower-tier priority - patch in normal cycles. The conflict worth flagging explicitly is EPSS/percentile (high) versus CVSS and the admin-only scope (low real-world reach); the admin precondition should take precedence in prioritization. No data is missing or internally contradictory; the CVSS network vector is consistent with the web-based description.

A malicious or compromised administrator (or an attacker who tricks an admin via CSRF/social engineering) creates an Alert Transport whose name field contains an HTML/JS payload such as "'onfocus='alert(1)' autofocus=". When any administrator later opens the Alert Rules page, the unsanitized transport name renders in the Transports column and the JavaScript executes in that admin's authenticated session. A public POC with full reproduction steps exists in the GHSA advisory.