netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-c66p-64fj-jmc2
GHSA-g84x-g96g-rcjc
This commit is contained in:
advisory-database[bot]
2025-03-25 15:50:22 +00:00
parent a8331e1a50
commit 752abc4e07
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/01/GHSA-c66p-64fj-jmc2/GHSA-c66p-64fj-jmc2.json
+2 -2
View File
File diff suppressed because one or more lines are too long
advisories/github-reviewed/2025/01/GHSA-g84x-g96g-rcjc/GHSA-g84x-g96g-rcjc.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g84x-g96g-rcjc",
"modified": "2025-01-17T15:52:38Z",
"modified": "2025-03-25T15:48:42Z",
"published": "2025-01-16T17:33:10Z",
"aliases": [
"CVE-2025-23201"
],
"summary": "Librenms has a reflected XSS on error alert",
"details": "XSS on the parameters:`/addhost` -> param: community\n\n\nof Librenms versions 24.10.1 ([https://github.com/librenms/librenms](https://github.com/librenms/librenms)) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure.\n\n\n**Proof of Concept:**\n1. Navigate to the /addhost path.\n2. Fill in all required fields.\n3. In the Community field, enter the following payload: `\"><img src=a onerror=\"alert(1)\">`.\n![image](https://github.com/user-attachments/assets/025a7692-e730-4e3b-bca7-761ed2a60cf7)\n\n4. Submit the form to save changes.\n5 The script will execute when the error alert \"No reply with community + payload\" appears.\n![image](https://github.com/user-attachments/assets/4663e24a-4ff7-42f4-9c3d-3c5b5bf34017)\n\n\n\n**Impact:**\n\nExecution of Malicious Code\n\n",
"details": "XSS on the parameters:`/addhost` -> param: community\n\n\nof Librenms versions 24.10.1 ([https://github.com/librenms/librenms](https://github.com/librenms/librenms)) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure.\n\n\n**Proof of Concept:**\n1. Navigate to the /addhost path.\n2. Fill in all required fields.\n3. In the Community field, enter the following payload: `\"><img src=a onerror=\"alert(1)\">`.\n![image](https://github.com/user-attachments/assets/025a7692-e730-4e3b-bca7-761ed2a60cf7)\n\n4. Submit the form to save changes.\n5 The script will execute when the error alert \"No reply with community + payload\" appears.\n![image](https://github.com/user-attachments/assets/4663e24a-4ff7-42f4-9c3d-3c5b5bf34017)\n\n\n\n**Impact:**\n\nExecution of Malicious Code",
"severity": [
{
"type": "CVSS_V3",