Which products and versions are affected by CVE-2025-23200?

Affected: Librenms versions >= = 23.9.0. The full list is in the CVE brief.

Is CVE-2025-23200 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2025-23200 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2025-23200?

Public exploit code is available.

Is there a fix for CVE-2025-23200?

Fixed versions are available, including Librenms 24.11.0, librenms/librenms 24.10.1, librenms/librenms 24.11.0.

How urgently should CVE-2025-23200 be patched?

Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Request A Demo

WatchlistMedium

CVE-2025-23200Librenms XSS

LibreNMS Misc Section Stored Cross-site Scripting vulnerability

Published Jan 16, 2025 · Updated Aug 12, 2026 · Also known as GHSA-c66p-64fj-jmc2

Key Facts

Routine patching

CVE-2025-23200 is a medium-severity vulnerability (CVSS 5.4 v3.1) affecting Librenms, librenms/librenms (composer).
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 31% probability of exploitation in the next 30 days.
Fixed versions are available, including Librenms 24.11.0, librenms/librenms 24.10.1, librenms/librenms 24.11.0.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Scores

CVSS v3.1

5.4

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS (30-day exploit likelihood)

31%

Higher than 98.2% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

37/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisoryhttps://www.cve.org/CVERecord?id=CVE-2025-23200
advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2025-23200
advisoryGHSA advisory
advisoryhttps://github.com/librenms/librenms/commit/26258a2518dbfa55b213ec4b90ec16ed97efb597
advisoryhttps://github.com/librenms/librenms/pull/16722

Description

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: ajax_form.php -> param: state. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts.

When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0.

Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected Products

3 affected entries in total

Product	Affected versions	Fixed in
LibrenmsLibrenms	>= < 24.11.0	24.11.0
librenms/librenmscomposer	>= 23.9.0	24.11.0

Patched Releases

Librenms

24.11.0

librenms/librenms

24.10.1, 24.11.0

Timeline

Publicly disclosed
Jan 16, 2025
Last updated
Aug 12, 2026

Weakness Type

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References

2 more references in the full CVE brief

FAQ

Common Questions.

librenms is a community-based GPL-licensed network monitoring system.
Affected: Librenms versions >= < 24.11.0; librenms/librenms (composer) versions >= 23.9.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Librenms 24.11.0, librenms/librenms 24.10.1, librenms/librenms 24.11.0.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Is CVE-2025-23200 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.