Emoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism.
Priority MEDIUM 60CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
Emoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism. This vulnerability allows authenticated attackers with API access to inject malicious JavaScript code that executes when administrators view the application logs.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00195 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openenergymonitor:emoncms:11.7.3:*:*:*:*:*:*:* | 11.7.3 | Vulnerable | Openenergymonitor |
- cpe:2.3:a:openenergymonitor:emoncms:11.7.3:*:*:*:*:*:*:* Versions 11.7.3 Vulnerable ·Openenergymonitor
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-60936
- 2026-10-03 Alias added: GHSA-r2f6-mm34-mhfx
References
More Openenergymonitor Emoncms vulnerabilities
- TI-2025-16814 A SQL Injection vulnerability exists in the /feed/insert.json endpoint of the Emoncms… CVSS 3.1CRITICAL 9.8
- TI-2025-37864 Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature… CVSS 3.1HIGH 7.5
- TI-2021-08395 Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter. CVSS 3.1MEDIUM 6.1
- TI-2017-03879 An issue was discovered in Emoncms through 9.8.0. CVSS 3.1MEDIUM 6.1
- TI-2019-15949 Cross-site scripting in OpenEnergyMonitor Project Emoncms CVSS 3.0MEDIUM 5.4
Sources
- CVE-2025-60936 · CVE Program
- CVE-2025-60936 · NVD
- FIRST EPSS
- GHSA-r2f6-mm34-mhfx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences