CVE-2025-65093
Medium · 5.5LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint
CVSS
5.5
EPSS
3.9%
Published
Nov 18, 2025
CISA due date
—
The record
A **Boolean-Based Blind SQL Injection** vulnerability was identified in the LibreNMS application at the `/ajax_output.php` endpoint. The `hostname` parameter is interpolated directly into an SQL query without proper sanitization or parameter binding, allowing an attacker to manipulate the query logic and infer data from the database through conditional responses. ---
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | librenms/librenms | 0 | No fix |
| Packagist | librenms/librenms | 0 | 25.11.0 |
Related vulnerabilities
- GHSA-6pmj-xjxp-p8g9 LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in… Same vulnerability
- CVE-2024-51092 LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command… Also affects librenms/librenms
- CVE-2026-26992 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26991 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-27016 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26989 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26990 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26988 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms