LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a boolean-based blind SQL injection vulnerability was identified in the LibreNMS application at the /ajax_output.php endpoint. The hostname parameter is interpolated directly into an SQL query without proper sanitization or parameter binding, allowing an attacker to manipulate the query logic and infer data from the database through conditional responses. This issue has been patched in version 25.11.0.
References
| Link | Resource |
|---|---|
| https://github.com/librenms/librenms/security/advisories/GHSA-6pmj-xjxp-p8g9 | Exploit Vendor Advisory |
| https://github.com/librenms/librenms/security/advisories/GHSA-6pmj-xjxp-p8g9 | Exploit Vendor Advisory |
Configurations
History
20 Nov 2025, 16:18
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:* | |
| References | () https://github.com/librenms/librenms/security/advisories/GHSA-6pmj-xjxp-p8g9 - Exploit, Vendor Advisory | |
| First Time |
Librenms librenms
Librenms |
19 Nov 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/librenms/librenms/security/advisories/GHSA-6pmj-xjxp-p8g9 - |
18 Nov 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-18 23:15
Updated : 2025-11-20 16:18
NVD link : CVE-2025-65093
Mitre link : CVE-2025-65093
CVE.ORG link : CVE-2025-65093
JSON object : View
Products Affected
librenms
- librenms
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')