LibreNMS, a PHP/MySQL/SNMP network monitoring platform, has a stored cross‑site scripting flaw in versions 26.1.1 and earlier. The vulnerability arises when the name of a port group is accepted without sanitization during creation. An attacker with administrative access can inject crafted JavaScript into the name field. Once the port group is stored, any subsequent viewing of the group—such as on the listing page with Edit and Delete buttons—will execute the embedded script in the context of other users’ browsers, potentially enabling session hijacking, credential theft, or defacement of the application for users who view the page.

The vulnerability impacts LibreNMS deployments running version 26.1.1 or earlier. The vendor product is LibreNMS, an open‑source network monitoring system. The affected components are the web interface handling POST requests to /port‑groups. The fix is available in release 26.2.0.

The CVSS base score is 5.1, indicating moderate severity. EPSS shows an exploitation probability of less than 1%, suggesting the likelihood of exploitation is low. The vulnerability is not listed in CISA's KEV catalog. The attack vector requires the attacker to have administrative privileges to create a malicious port group, so compromised or mis‑privileged accounts pose the primary risk. A successful exploit would allow an attacker to compromise the sessions of other users who examine the port‑group list.