CVE-2025-61789

MediumCVSS 6.5/10Last modified Oct 9, 2026

Description

Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assigned to it. Versions 1.1.4 and 1.2.3 respond with an error if such a custom variable is used.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-204

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2025
Last modified
Oct 9, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-61799.8Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disablCVE-2025-617926.4Quadient DS-700 iQ devices through 2025-09-30 might have a race condition during the quick clicking of (in order) the Question Mark button, CVE-2025-617955.3Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processiCVE-2025-617965.4Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2025-617975.4Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2025-617987.8Dimension versions 4.1.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in CVE-2025-617997.8Dimension versions 4.1.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in CVE-2025-61808.5The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, poteCVE-2025-618007.8Dimension versions 4.1.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code exeCVE-2025-618017.8Dimension versions 4.1.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the conCVE-2025-618027.8Substance3D - Stager versions 3.1.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code executionCVE-2025-618037.8Substance3D - Stager versions 3.1.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitra
CVE-2025-61789: Medium severity, CVSS 6.5 | Vulnix