Skip to main content

Nagios Core EUVDEUVD-2026-57324

| CVE-2026-48550 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-12 VulnCheck GHSA-hc96-98mh-7j3h
XSS Nagios Xi Nagios Core Nagios Enterprises Llc
5.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.1 MEDIUM

Network-delivered reflected XSS with no attacker privileges; scope changes to victim browser; user interaction required; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SUSE
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 12, 2026 - 17:07 vuln.today
CVE Published
Aug 12, 2026 - 16:30 cve.org
MEDIUM 5.1

DescriptionCVE.org

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.

AnalysisAI

Reflected cross-site scripting in Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of an authenticated victim. The injection point is the NagFormId parameter in cmd.cgi, which is insufficiently sanitized before being reflected in server responses. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker requires no authentication and no special privileges - the malicious URL is crafted externally and requires zero access to the Nagios server. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.1 (Medium) reflects the fundamental constraint of this vulnerability: it requires active user interaction (UI:A), meaning the victim must click a malicious link while authenticated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Nagios Core to version 4.5.14 or later, and Nagios XI to version 2026R1.7 or later, per the vendor advisory at https://www.nagios.com/security-disclosures/nagios-core/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nagios Xi

View all
CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25297 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25299 MEDIUM POC
6.1 Feb 15

Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerabili
CVE-2018-15708 CRITICAL POC
9.8 Nov 14

Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP r
CVE-2018-8734 CRITICAL POC
9.8 Apr 18

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker
CVE-2018-8733 CRITICAL POC
9.8 Apr 18

Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an

CVE-2021-37343 HIGH POC
8.8 Aug 13

A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post au
CVE-2019-15949 HIGH POC
8.8 Sep 05

Nagios XI before 5.6.6 allows remote command execution as root. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2018-8736 HIGH POC
8.8 Apr 18

A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RC
CVE-2018-8735 HIGH POC
8.8 Apr 18

Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execut
CVE-2013-6875 HIGH POC
7.5 Nov 26

SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allo

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Share

EUVD-2026-57324 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy