CVE-2024-50352

CVE-2024-50352 describes a Stored Cross-Site Scripting (XSS) vulnerability in LibreNMS, an open-source network monitoring system, specifically affecting the "Services" section of the Device Overview page. Authenticated users can inject malicious JavaScript via the "name" parameter when adding a service, leading to potential execution of arbitrary code in other users' sessions. This medium-severity vulnerability (CVSS 5.4) has a low attack complexity and requires user interaction, potentially compromising user accounts and enabling unauthorized actions. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.