The following table lists the changes that have been made to the
CVE-2025-54138 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.
Jul. 22, 2025
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Description | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajax_form.php endpoint that permits Remote File Inclusion based on user-controlled POST input. The application directly uses the type parameter to dynamically include .inc.php files from the trusted path includes/html/forms/, without validation or allowlisting. This pattern introduces a latent Remote Code Execution (RCE) vector if an attacker can stage a file in this include path — for example, via symlink, development misconfiguration, or chained vulnerabilities. This is fixed in version 25.7.0. | |
| Added | CVSS V3.1 | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | |
| Added | CWE | CWE-98 | |
| Added | Reference | https://github.com/librenms/librenms/commit/ec89714d929ef0cf2321957ed9198b0f18396c81 | |
| Added | Reference | https://github.com/librenms/librenms/pull/17990 | |
| Added | Reference | https://github.com/librenms/librenms/releases/tag/25.7.0 | |
| Added | Reference | https://github.com/librenms/librenms/security/advisories/GHSA-gq96-8w38-hhj2 |
CVE ID : CVE-2025-10304 Published : Dec. 3, 2025, 3:27 a.m. | 26 minutes ago Description : The Everest Backup –
CVE ID : CVE-2025-12585 Published : Dec. 3, 2025, 3:27 a.m. | 26 minutes ago Description : The MxChat – AI
Unit A5, Endeavour Business Park
Penner Road, Havant
PO9 1QN
Company Registration Number: 5334133
Company VAT Number: 855 7246 95
