LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a boolean-based blind SQL injection vulnerability was identified in the LibreNMS application at the /ajax_output.php endpoint. The hostname parameter is interpolated directly into an SQL query without proper sanitization or parameter binding, allowing an attacker to manipulate the query logic and infer data from the database through conditional responses. This issue has been patched in version 25.11.0.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/librenms/librenms/security/advisories/GHSA-6pmj-xjxp-p8g9 Exploit, Vendor Advisory
- https://github.com/librenms/librenms/security/advisories/GHSA-6pmj-xjxp-p8g9 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.5 · librenmsNVD modified 2026-10-19 13:10
Affected (CPE criteria) 1
cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*
References 2
- https://github.com/librenms/librenms/security/advisories/GHSA-6pmj-xjxp-p8g9 Exploit, Vendor Advisory
- https://github.com/librenms/librenms/security/advisories/GHSA-6pmj-xjxp-p8g9 Exploit, Vendor Advisory