CVE-2025-65093

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a boolean-based blind SQL injection vulnerability was identified in the LibreNMS application at the /ajax_output.php endpoint. The hostname parameter is interpolated directly into an SQL query without proper sanitization or parameter binding, allowing an attacker to manipulate the query logic and infer data from the database through conditional responses. This issue has been patched in version 25.11.0.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/librenms/librenms/security/advisories/GHSA-6pmj-xjxp-p8g9	Exploit Vendor Advisory
https://github.com/librenms/librenms/security/advisories/GHSA-6pmj-xjxp-p8g9	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) LibreNMS es una herramienta de monitoreo de red con descubrimiento automático basada en PHP/MySQL/SNMP. Versiones anteriores a la versión 25.11.0, se identificó una vulnerabilidad de inyección SQL ciega basada en booleanos en la aplicación LibreNMS en el endpoint /ajax_output.php. El parámetro hostname se interpola directamente en una consulta SQL sin una sanitización adecuada o vinculación de parámetros, permitiendo a un atacante manipular la lógica de la consulta e inferir datos de la base de datos a través de respuestas condicionales. Este problema ha sido parcheado en la versión 25.11.0.

Information

Published : 2025-11-18 23:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-65093

Mitre link : CVE-2025-65093

CVE.ORG link : CVE-2025-65093

JSON object : View

Products Affected

librenms

librenms

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-65093", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65093", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T14:58:37.261599Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "librenms", "product": "librenms", "versions": [{"status": "affected", "version": "< 25.11.0"}]}]}], "published": "2025-11-18T23:15:57.690", "references": [{"url": "https://github.com/librenms/librenms/security/advisories/GHSA-6pmj-xjxp-p8g9", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/librenms/librenms/security/advisories/GHSA-6pmj-xjxp-p8g9", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a boolean-based blind SQL injection vulnerability was identified in the LibreNMS application at the /ajax_output.php endpoint. The hostname parameter is interpolated directly into an SQL query without proper sanitization or parameter binding, allowing an attacker to manipulate the query logic and infer data from the database through conditional responses. This issue has been patched in version 25.11.0."}, {"lang": "es", "value": "LibreNMS es una herramienta de monitoreo de red con descubrimiento autom\u00e1tico basada en PHP/MySQL/SNMP. Versiones anteriores a la versi\u00f3n 25.11.0, se identific\u00f3 una vulnerabilidad de inyecci\u00f3n SQL ciega basada en booleanos en la aplicaci\u00f3n LibreNMS en el endpoint /ajax_output.php. El par\u00e1metro hostname se interpola directamente en una consulta SQL sin una sanitizaci\u00f3n adecuada o vinculaci\u00f3n de par\u00e1metros, permitiendo a un atacante manipular la l\u00f3gica de la consulta e inferir datos de la base de datos a trav\u00e9s de respuestas condicionales. Este problema ha sido parcheado en la versi\u00f3n 25.11.0."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB2997C4-F47F-4823-8E14-6FBC84E84C74", "versionEndExcluding": "25.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}