Nagios
Monthly
Remote code execution in Nagios Xi through command injection in the esensors_websensor_configwizard_func method allows authenticated attackers to execute arbitrary commands with service account privileges. The vulnerability stems from insufficient input validation on user-supplied parameters passed to system calls. With a CVSS score of 8.8 and no patch currently available, this poses a significant risk to authenticated users of affected Nagios installations.
Remote code execution in Nagios Xi's monitoringwizard module allows authenticated attackers to execute arbitrary commands through insufficient input validation in system calls. An attacker with valid credentials can exploit this command injection vulnerability to gain code execution with service account privileges on affected installations. No patch is currently available for this high-severity vulnerability.
Nagios Xi for iOS is vulnerable to command injection in the zabbixagent_configwizard_func method due to insufficient input validation, allowing authenticated attackers to execute arbitrary code with service account privileges. The vulnerability requires valid credentials but no user interaction to exploit, and no patch is currently available. Exploitation could grant attackers full system access on affected Nagios installations.
A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Nagios XI before 5.6.6 allows remote command execution as root. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 76.4%.
Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.9%.
Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable application directories. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. No vendor patch available.
Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server feature to obtain root privileges on the. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios XI versions prior to 5.8.7 using embedded Nagios Core are vulnerable to cross-site scripting (XSS) via the Core UI’s Views URL handling (escape_string()). Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in Nagios Log Server (versions 2024 R1 through 2024R1.3.1, and all releases prior to 2024R1.3.2) lets an authenticated user elevate their own privileges by abusing the account email-change workflow. Because the application fails to validate the submitted email value and appears to derive authorization state from the account's email identity, setting an invalid email value drives the account into an inconsistent state that bypasses intended access controls and grants elevated privileges. Exploitation requires a pre-existing valid account (authenticated, low-privilege is sufficient) and no victim interaction; there is no public exploit identified at time of analysis, and no CISA KEV listing, though the high CIA impact and low attack complexity make it an above-average-priority fix rather than a drop-everything emergency.
Command injection in Nagios XI's WinRM plugin allows an authenticated administrator to convert crafted plugin parameters into arbitrary OS commands executed as the Nagios XI web application user. Affected releases are Nagios XI prior to 2024R2, including 2024 R1 and its R1.x updates; the vendor changelog and security page list 2024R2 as the remediating release. No public exploit code or CISA KEV entry was identified at time of analysis, but the CVSS 4.0 base score is 9.4 because exploitation can fully compromise the Nagios host and related monitoring data.
Nagios XI deployments running a Neptune theme prior to 2024R1.4.2 disclose API key values to any authenticated user, including accounts that hold no API privileges, allowing that user to read their own or another user's API key. Exploitation requires valid credentials on the affected instance plus the Neptune theme rendering path, which is not the default configuration on every install, so exposure is limited to that intersection of prerequisites. Impact is confidentiality-only - harvested keys yield no immediate integrity or availability effect but become dangerous if separately reused against the Nagios XI API; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The independent assessment rates this a genuine but moderate-severity information-disclosure issue rather than a critical priority.
Command injection in the LDAP certificate removal function of Nagios Network Analyzer lets an authenticated administrator (CVSS PR:H) execute arbitrary operating-system commands on the underlying host, running with the privileges of the web application service account rather than root. The flaw is rated CVSS 4.0 8.6 (High) and affects Nagios Network Analyzer versions prior to 2024R2.0.1, including the 2024 R1.0.1, R1.0.2, R1.0.3 and 2024 R2 releases; it is a post-authentication issue, so successful exploitation requires valid administrator-level credentials and a deployment in which LDAP authentication/certificate features are actually configured. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the practical risk is bounded by the mandatory high-privilege prerequisite and the service-account context of the resulting code execution.
Stored cross-site scripting in Nagios Network Analyzer versions prior to 2024R1 lets an authenticated attacker with low privileges persist a malicious script through the Source Groups page (percentile calculator menu), which then executes in the browser of any other user who views that page. The vendor/VulnCheck-assigned CVSS 4.0 base score is 5.1, and our independent assessment rates it moderate: the attacker must already hold an account able to submit input to the Source Groups percentile-calculator menu (PR:L), and impact is only realized when a second victim renders the poisoned page (UI:P), yielding low confidentiality and integrity impact within a changed scope. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.76% (54th percentile), so prioritization should focus on hardening authenticated access rather than emergency patching.
Remote code execution in Nagios Log Server versions prior to 2024R1.3.1 allows an authenticated low-privileged attacker to execute arbitrary code in the context of the Log Server process by supplying a malformed dashboard ID to an internal API. The vulnerability is rated CVSS 9.4 (CVSS 4.0) but requires authentication (PR:L), and no public exploit code has been identified at time of analysis. This is a credible priority rather than a high-CVSS-but-low-risk issue, though the risk is gated by the authentication requirement.
Root-level system compromise on Nagios Log Server instances running versions prior to 2024R2.0.3 stems from the product's embedded Logstash process being configured to run as the root user, so any attacker who first obtains code execution inside Logstash - via an insecure third-party plugin, injection into the pipeline configuration, or a vulnerability in Logstash input parsing - inherits full root privileges on the host. The published CVSS 4.0 vector (9.3 Critical, AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact) frames this as a directly network-reachable, unauthenticated and trivially exploitable flaw; however, the underlying CWE-250 (Execution with Unnecessary Privileges) is an amplification weakness rather than a standalone remote code execution bug, because a separate exploitable Logstash flaw or malicious plugin/pipeline component is a hard precondition. Consistent with that, an independent assessment rates the issue under CVSS 3.1 as AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, with unauthenticated network reach but high attack complexity due to the required chaining. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation.
Non-administrator accounts on Nagios Log Server can delete global dashboards they should not be able to touch, because versions prior to 2024R2.0.3 fail to enforce authorization checks in the global dashboard deletion workflow (CWE-863, Incorrect Authorization). Exploitation requires a valid authenticated account with low privileges (CVSS 4.0 PR:L, UI:N) and is confined to integrity and availability impact on the shared monitoring UI, with no data disclosure or code execution, which is why the assessed CVSS 3.1 vector (7.1 under CVSS 4.0) maps to a moderate rather than urgent operational priority. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Information exposure in Nagios Log Server deployments running versions prior to 2024R2.0.3 occurs when a user's configured default dashboard has been deleted: instead of falling back to an empty, default dashboard, the application can resolve to some other dashboard and present it as the user's default view. This requires an authenticated account (CVSS 4.0 vector PR:L) and a specific pre-existing state - the user's own default dashboard must have been deleted so the flawed fallback path is reached - and meaningful exposure further depends on whether the deployment's dashboard sharing and access-control settings make a dashboard containing information beyond the user's intended scope reachable as that fallback. The impact is read-only confidentiality only (no integrity or availability effect), rated medium at CVSS 4.0 base 5.3 with EPSS 0.86% (57th percentile); no public exploit code and no CISA KEV entry are associated with this CVE, and the vendor has shipped a fixed release in 2024R2.0.3.
Cleartext transmission of cluster credentials in Nagios Log Server (all releases prior to 2024R2.0.2) lets an attacker who holds an adversary-in-the-middle position on the network path between cluster nodes intercept sensitive credentials that the cluster manager requests from peer nodes - the exchange stays unencrypted even when SSL/TLS is enabled in the product configuration. No credentials are required to reach the vulnerable request path (CVSS vector PR:N), but practical exploitation is constrained: it requires a clustered deployment and a privileged network interception foothold, so an external remote attacker without a foothold cannot exploit it, and single-node installations with no inter-node credential exchange are not exposed. Impact is limited to confidentiality (credential disclosure) that can then enable authentication as a cluster node or service account and follow-on lateral movement; no public exploit identified at time of analysis.
Nagios Log Server versions prior to 2024R2.0.2 handle AD/LDAP user-import credentials in cleartext, printing the plaintext password into the user interface, import results, logs, or diagnostic output where administrators can read it. The exposure is gated behind high-privilege access (CVSS 3.1 PR:H) and only occurs when the AD/LDAP account-import feature is actually used, so organizations that never import directory users through this workflow are not affected. EPSS is low at 0.63% (48th percentile) and no public exploit code has been identified at time of analysis; this is a moderate, authentication-gated information-disclosure flaw rather than an urgent internet-facing threat, and no KEV entry exists.
Overly permissive systemd unit file permissions in Nagios XI installations prior to 2024R1.4.2 leave files such as nagios.service marked executable when no execution privilege is required, unnecessarily widening the local attack surface on the monitoring host. The weakness is local-only and, per the vendor's own framing, only facilitates abuse of service operations when chained with a separate weakness, so it does not independently yield code execution, privilege escalation, or data disclosure; our assessment rates it CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (low confidentiality and integrity, no availability impact). No public exploit code and no CISA KEV entry have been identified at time of analysis, so this is best treated as a low-to-moderate hardening gap rather than an urgent patch trigger.
Nagios XI instances running versions prior to 2024R1.4.2 are exposed to a high-severity remote code execution vulnerability in the Business Process Intelligence (BPI) component, where an authenticated administrative user can exploit insufficient validation of the bpi_logfile and bpi_configfile parameters to create or overwrite executable files in the webroot and then execute them as the web application user. The flaw requires administrative privileges (PR:H) and is not exploitable by anonymous or low-privileged remote attackers; no public exploit code has been identified at time of analysis, and the CVSS 4.0 score is 9.4 with a 3.1 assessment of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Successful exploitation yields arbitrary command execution with web application user privileges, potentially leading to full host compromise, but the administrative gating condition tempers real-world urgency compared to unauthenticated RCE flaws.
The OTP verification step in Nagios Fusion 2024R1.2 and 2024R2.1 accepts an unlimited number of code guesses, so an attacker who already holds a valid username and password for a Fusion account can brute-force the one-time code and complete authentication without ever possessing the second factor. Because the flaw sits after the first authentication factor, a fully anonymous attacker cannot reach the vulnerable component; the input vector is scored adjacent-network (AV:A) while our independent assessment treats it as network-reachable (AV:N), so real exposure depends on whether the Fusion login interface is internet-facing. No CISA KEV entry exists, a public PoC reference is published on GitHub but is not verified as working exploit code, and EPSS is 0.71% (53rd percentile), which supports a prioritize-this-week rather than emergency posture.
Authenticated users holding only read-only API access in Nagios Log Server versions prior to 2024R1.3.2 can stop the underlying Elasticsearch service by calling the system stop endpoint with the elasticsearch subsystem parameter, degrading availability of the log ingestion, indexing, and search stack. The vulnerability is an incorrect authorization flaw (CWE-863) rated CVSS 6.5 with a PR:L vector, meaning the attacker must already possess valid credentials - no unauthenticated path exists - and impact is limited to availability with no data disclosure or modification. Publicly available exploit code exists (a GitHub proof-of-concept), and EPSS places the issue at roughly 2.77% (86th percentile), but there is no confirmation of active exploitation in CISA KEV; a vendor fix is available in 2024R1.3.2.
Cleartext exposure of administrative API keys in Nagios Log Server versions prior to 2024R1.3.2 allows authenticated low-privileged users to retrieve sensitive credentials via the /nagioslogserver/index.php/api/system/get_users endpoint. Publicly available exploit code exists (Exploit-DB 52177), though active exploitation has not been confirmed. The flaw requires only a valid low-privileged account and no user interaction, and successful retrieval can provide attackers with keys that grant administrative access to the log server's API.
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalidation and stale token handling. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 16.0%.
A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized access and account takeover. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.
A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actions, including stopping system services. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.
Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and email addresses of all current users. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History Tab component. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Account. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.
Privilege escalation in Nagios XI 2024R1.01 allows an authenticated low-privileged attacker to gain elevated system access by submitting a crafted Dashlet through the Autodiscover component. The vulnerability stems from improper privilege management (CWE-269), meaning the application fails to enforce appropriate access controls when processing Dashlet configurations. A public proof-of-concept exploit exists on GitHub, and the 73rd-percentile EPSS score suggests elevated real-world exploitation interest despite no current CISA KEV listing.
An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 13.5%.
Nagios XI before v5.8.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the ajax.php script in CCM 3.1.5. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Performance Settings page under the Admin panel. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios XI v5.8.6 was discovered to contain a SQL injection vulnerability via the mib_name parameter at the Manage MIBs page. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the MTR component in version 1.0.4. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before v5.8.7 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at auditlog.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Settings page under the Admin panel. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime for any host/services. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformatting/editing of emails from an official email address. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Nagios XI 5.8.5. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Nagios XI 5.8.5. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Nagios XI 5.8.5. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Nagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table_population.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Remote code execution in Nagios Xi through command injection in the esensors_websensor_configwizard_func method allows authenticated attackers to execute arbitrary commands with service account privileges. The vulnerability stems from insufficient input validation on user-supplied parameters passed to system calls. With a CVSS score of 8.8 and no patch currently available, this poses a significant risk to authenticated users of affected Nagios installations.
Remote code execution in Nagios Xi's monitoringwizard module allows authenticated attackers to execute arbitrary commands through insufficient input validation in system calls. An attacker with valid credentials can exploit this command injection vulnerability to gain code execution with service account privileges on affected installations. No patch is currently available for this high-severity vulnerability.
Nagios Xi for iOS is vulnerable to command injection in the zabbixagent_configwizard_func method due to insufficient input validation, allowing authenticated attackers to execute arbitrary code with service account privileges. The vulnerability requires valid credentials but no user interaction to exploit, and no patch is currently available. Exploitation could grant attackers full system access on affected Nagios installations.
A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Nagios XI before 5.6.6 allows remote command execution as root. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 76.4%.
Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.9%.
Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable application directories. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. No vendor patch available.
Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server feature to obtain root privileges on the. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios XI versions prior to 5.8.7 using embedded Nagios Core are vulnerable to cross-site scripting (XSS) via the Core UI’s Views URL handling (escape_string()). Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in Nagios Log Server (versions 2024 R1 through 2024R1.3.1, and all releases prior to 2024R1.3.2) lets an authenticated user elevate their own privileges by abusing the account email-change workflow. Because the application fails to validate the submitted email value and appears to derive authorization state from the account's email identity, setting an invalid email value drives the account into an inconsistent state that bypasses intended access controls and grants elevated privileges. Exploitation requires a pre-existing valid account (authenticated, low-privilege is sufficient) and no victim interaction; there is no public exploit identified at time of analysis, and no CISA KEV listing, though the high CIA impact and low attack complexity make it an above-average-priority fix rather than a drop-everything emergency.
Command injection in Nagios XI's WinRM plugin allows an authenticated administrator to convert crafted plugin parameters into arbitrary OS commands executed as the Nagios XI web application user. Affected releases are Nagios XI prior to 2024R2, including 2024 R1 and its R1.x updates; the vendor changelog and security page list 2024R2 as the remediating release. No public exploit code or CISA KEV entry was identified at time of analysis, but the CVSS 4.0 base score is 9.4 because exploitation can fully compromise the Nagios host and related monitoring data.
Nagios XI deployments running a Neptune theme prior to 2024R1.4.2 disclose API key values to any authenticated user, including accounts that hold no API privileges, allowing that user to read their own or another user's API key. Exploitation requires valid credentials on the affected instance plus the Neptune theme rendering path, which is not the default configuration on every install, so exposure is limited to that intersection of prerequisites. Impact is confidentiality-only - harvested keys yield no immediate integrity or availability effect but become dangerous if separately reused against the Nagios XI API; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The independent assessment rates this a genuine but moderate-severity information-disclosure issue rather than a critical priority.
Command injection in the LDAP certificate removal function of Nagios Network Analyzer lets an authenticated administrator (CVSS PR:H) execute arbitrary operating-system commands on the underlying host, running with the privileges of the web application service account rather than root. The flaw is rated CVSS 4.0 8.6 (High) and affects Nagios Network Analyzer versions prior to 2024R2.0.1, including the 2024 R1.0.1, R1.0.2, R1.0.3 and 2024 R2 releases; it is a post-authentication issue, so successful exploitation requires valid administrator-level credentials and a deployment in which LDAP authentication/certificate features are actually configured. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the practical risk is bounded by the mandatory high-privilege prerequisite and the service-account context of the resulting code execution.
Stored cross-site scripting in Nagios Network Analyzer versions prior to 2024R1 lets an authenticated attacker with low privileges persist a malicious script through the Source Groups page (percentile calculator menu), which then executes in the browser of any other user who views that page. The vendor/VulnCheck-assigned CVSS 4.0 base score is 5.1, and our independent assessment rates it moderate: the attacker must already hold an account able to submit input to the Source Groups percentile-calculator menu (PR:L), and impact is only realized when a second victim renders the poisoned page (UI:P), yielding low confidentiality and integrity impact within a changed scope. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.76% (54th percentile), so prioritization should focus on hardening authenticated access rather than emergency patching.
Remote code execution in Nagios Log Server versions prior to 2024R1.3.1 allows an authenticated low-privileged attacker to execute arbitrary code in the context of the Log Server process by supplying a malformed dashboard ID to an internal API. The vulnerability is rated CVSS 9.4 (CVSS 4.0) but requires authentication (PR:L), and no public exploit code has been identified at time of analysis. This is a credible priority rather than a high-CVSS-but-low-risk issue, though the risk is gated by the authentication requirement.
Root-level system compromise on Nagios Log Server instances running versions prior to 2024R2.0.3 stems from the product's embedded Logstash process being configured to run as the root user, so any attacker who first obtains code execution inside Logstash - via an insecure third-party plugin, injection into the pipeline configuration, or a vulnerability in Logstash input parsing - inherits full root privileges on the host. The published CVSS 4.0 vector (9.3 Critical, AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact) frames this as a directly network-reachable, unauthenticated and trivially exploitable flaw; however, the underlying CWE-250 (Execution with Unnecessary Privileges) is an amplification weakness rather than a standalone remote code execution bug, because a separate exploitable Logstash flaw or malicious plugin/pipeline component is a hard precondition. Consistent with that, an independent assessment rates the issue under CVSS 3.1 as AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, with unauthenticated network reach but high attack complexity due to the required chaining. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation.
Non-administrator accounts on Nagios Log Server can delete global dashboards they should not be able to touch, because versions prior to 2024R2.0.3 fail to enforce authorization checks in the global dashboard deletion workflow (CWE-863, Incorrect Authorization). Exploitation requires a valid authenticated account with low privileges (CVSS 4.0 PR:L, UI:N) and is confined to integrity and availability impact on the shared monitoring UI, with no data disclosure or code execution, which is why the assessed CVSS 3.1 vector (7.1 under CVSS 4.0) maps to a moderate rather than urgent operational priority. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Information exposure in Nagios Log Server deployments running versions prior to 2024R2.0.3 occurs when a user's configured default dashboard has been deleted: instead of falling back to an empty, default dashboard, the application can resolve to some other dashboard and present it as the user's default view. This requires an authenticated account (CVSS 4.0 vector PR:L) and a specific pre-existing state - the user's own default dashboard must have been deleted so the flawed fallback path is reached - and meaningful exposure further depends on whether the deployment's dashboard sharing and access-control settings make a dashboard containing information beyond the user's intended scope reachable as that fallback. The impact is read-only confidentiality only (no integrity or availability effect), rated medium at CVSS 4.0 base 5.3 with EPSS 0.86% (57th percentile); no public exploit code and no CISA KEV entry are associated with this CVE, and the vendor has shipped a fixed release in 2024R2.0.3.
Cleartext transmission of cluster credentials in Nagios Log Server (all releases prior to 2024R2.0.2) lets an attacker who holds an adversary-in-the-middle position on the network path between cluster nodes intercept sensitive credentials that the cluster manager requests from peer nodes - the exchange stays unencrypted even when SSL/TLS is enabled in the product configuration. No credentials are required to reach the vulnerable request path (CVSS vector PR:N), but practical exploitation is constrained: it requires a clustered deployment and a privileged network interception foothold, so an external remote attacker without a foothold cannot exploit it, and single-node installations with no inter-node credential exchange are not exposed. Impact is limited to confidentiality (credential disclosure) that can then enable authentication as a cluster node or service account and follow-on lateral movement; no public exploit identified at time of analysis.
Nagios Log Server versions prior to 2024R2.0.2 handle AD/LDAP user-import credentials in cleartext, printing the plaintext password into the user interface, import results, logs, or diagnostic output where administrators can read it. The exposure is gated behind high-privilege access (CVSS 3.1 PR:H) and only occurs when the AD/LDAP account-import feature is actually used, so organizations that never import directory users through this workflow are not affected. EPSS is low at 0.63% (48th percentile) and no public exploit code has been identified at time of analysis; this is a moderate, authentication-gated information-disclosure flaw rather than an urgent internet-facing threat, and no KEV entry exists.
Overly permissive systemd unit file permissions in Nagios XI installations prior to 2024R1.4.2 leave files such as nagios.service marked executable when no execution privilege is required, unnecessarily widening the local attack surface on the monitoring host. The weakness is local-only and, per the vendor's own framing, only facilitates abuse of service operations when chained with a separate weakness, so it does not independently yield code execution, privilege escalation, or data disclosure; our assessment rates it CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (low confidentiality and integrity, no availability impact). No public exploit code and no CISA KEV entry have been identified at time of analysis, so this is best treated as a low-to-moderate hardening gap rather than an urgent patch trigger.
Nagios XI instances running versions prior to 2024R1.4.2 are exposed to a high-severity remote code execution vulnerability in the Business Process Intelligence (BPI) component, where an authenticated administrative user can exploit insufficient validation of the bpi_logfile and bpi_configfile parameters to create or overwrite executable files in the webroot and then execute them as the web application user. The flaw requires administrative privileges (PR:H) and is not exploitable by anonymous or low-privileged remote attackers; no public exploit code has been identified at time of analysis, and the CVSS 4.0 score is 9.4 with a 3.1 assessment of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Successful exploitation yields arbitrary command execution with web application user privileges, potentially leading to full host compromise, but the administrative gating condition tempers real-world urgency compared to unauthenticated RCE flaws.
The OTP verification step in Nagios Fusion 2024R1.2 and 2024R2.1 accepts an unlimited number of code guesses, so an attacker who already holds a valid username and password for a Fusion account can brute-force the one-time code and complete authentication without ever possessing the second factor. Because the flaw sits after the first authentication factor, a fully anonymous attacker cannot reach the vulnerable component; the input vector is scored adjacent-network (AV:A) while our independent assessment treats it as network-reachable (AV:N), so real exposure depends on whether the Fusion login interface is internet-facing. No CISA KEV entry exists, a public PoC reference is published on GitHub but is not verified as working exploit code, and EPSS is 0.71% (53rd percentile), which supports a prioritize-this-week rather than emergency posture.
Authenticated users holding only read-only API access in Nagios Log Server versions prior to 2024R1.3.2 can stop the underlying Elasticsearch service by calling the system stop endpoint with the elasticsearch subsystem parameter, degrading availability of the log ingestion, indexing, and search stack. The vulnerability is an incorrect authorization flaw (CWE-863) rated CVSS 6.5 with a PR:L vector, meaning the attacker must already possess valid credentials - no unauthenticated path exists - and impact is limited to availability with no data disclosure or modification. Publicly available exploit code exists (a GitHub proof-of-concept), and EPSS places the issue at roughly 2.77% (86th percentile), but there is no confirmation of active exploitation in CISA KEV; a vendor fix is available in 2024R1.3.2.
Cleartext exposure of administrative API keys in Nagios Log Server versions prior to 2024R1.3.2 allows authenticated low-privileged users to retrieve sensitive credentials via the /nagioslogserver/index.php/api/system/get_users endpoint. Publicly available exploit code exists (Exploit-DB 52177), though active exploitation has not been confirmed. The flaw requires only a valid low-privileged account and no user interaction, and successful retrieval can provide attackers with keys that grant administrative access to the log server's API.
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalidation and stale token handling. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 16.0%.
A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized access and account takeover. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.
A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actions, including stopping system services. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.
Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and email addresses of all current users. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History Tab component. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Account. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.
Privilege escalation in Nagios XI 2024R1.01 allows an authenticated low-privileged attacker to gain elevated system access by submitting a crafted Dashlet through the Autodiscover component. The vulnerability stems from improper privilege management (CWE-269), meaning the application fails to enforce appropriate access controls when processing Dashlet configurations. A public proof-of-concept exploit exists on GitHub, and the 73rd-percentile EPSS score suggests elevated real-world exploitation interest despite no current CISA KEV listing.
An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 13.5%.
Nagios XI before v5.8.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the ajax.php script in CCM 3.1.5. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Performance Settings page under the Admin panel. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios XI v5.8.6 was discovered to contain a SQL injection vulnerability via the mib_name parameter at the Manage MIBs page. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the MTR component in version 1.0.4. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before v5.8.7 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at auditlog.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Settings page under the Admin panel. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime for any host/services. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformatting/editing of emails from an official email address. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Nagios XI 5.8.5. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Nagios XI 5.8.5. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Nagios XI 5.8.5. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Nagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table_population.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.