Nagios

Records303All Threatist records

Exploited (KEV)4In CISA KEV

CVSS critical52CVSS 9.0–10.0

CVSS high102CVSS 7.0–8.9

Exploited now

Nagios records in CISA KEV

TI-2021-07543 Nagios XI OS Command Injection CRITICAL 97KEV 2022-01-18 TI-2021-07544 Nagios XI OS Command Injection CRITICAL 97KEV 2022-01-18 TI-2021-07545 Nagios XI OS Command Injection CRITICAL 97KEV 2022-01-18 TI-2019-11993 Nagios XI Remote Code Execution Vulnerability CRITICAL 97KEV 2021-11-03

Components

Products in the NVD configurations · select one to filter the records

Nagios Xi 192 records CRITICAL Nagios 37 records HIGH Log Server 23 records HIGH Fusion 19 records MEDIUM Network Analyzer 7 records MEDIUM Nagios Core 5 records MEDIUM Incident Manager 3 records MEDIUM Plugins 3 records MEDIUM

Records

303 records

TI-2021-07545 CVE-2021-25298 · GHSA-6gq5-wx57-577c

Nagios XI version xi-5.7.5 is affected by OS command injection.

CRITICAL 97KEV

Nagios XI version xi-5.7.5 is affected by OS command injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.73641 Published 2021-02-15 No fix listed CWE-78

TI-2021-07544 CVE-2021-25297 · GHSA-5924-w244-8fxp

Nagios XI version xi-5.7.5 is affected by OS command injection.

CRITICAL 97KEV

Nagios XI version xi-5.7.5 is affected by OS command injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.56659 Published 2021-02-15 No fix listed CWE-78

TI-2021-07543 CVE-2021-25296 · GHSA-8hgr-54hv-7pgc

Nagios XI version xi-5.7.5 is affected by OS command injection.

CRITICAL 97KEV

Nagios XI version xi-5.7.5 is affected by OS command injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.71935 Published 2021-02-15 No fix listed

TI-2019-11993 CVE-2019-15949 · GHSA-8qv6-943v-r8gm

Nagios XI before 5.6.6 allows remote command execution as root.

CRITICAL 97KEV

Nagios XI before 5.6.6 allows remote command execution as root.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.77039 Published 2019-09-05 No fix listed CWE-78

TI-2023-26027 CVE-2023-48085 · GHSA-v8x2-pmhm-gqcj

Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE)…

CRITICAL 88

Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.75844 Published 2023-12-14 No fix listed CWE-94

TI-2021-15313 CVE-2021-37344 · GHSA-664c-v27v-xcf6

Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution…

CRITICAL 86

Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.96772 Published 2021-08-13 No fix listed CWE-78

TI-2018-11196 CVE-2018-15708 · GHSA-mxhr-3xg4-5hx7

Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute…

CRITICAL 85

Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.89362 Published 2018-11-14 No fix listed

TI-2024-16107 CVE-2024-24401 · GHSA-73wx-63h7-3wh6

SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute…

HIGH 82

SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.45884 Published 2024-02-26 No fix listed CWE-89

TI-2021-15319 CVE-2021-37350 · GHSA-h349-h9cf-xhfx

Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk…

HIGH 82

Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.7925 Published 2021-08-13 No fix listed CWE-89

TI-2021-15315 CVE-2021-37346 · GHSA-xffq-gv76-3257

Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution…

HIGH 80

Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.73586 Published 2021-08-13 No fix listed CWE-78

TI-2026-01700 CVE-2026-2043 · GHSA-q77w-wghg-55fv

OS command injection in Nagios Host

HIGH 79

Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.75421 Published 2026-02-20 No fix listed CWE-78

TI-2026-01698 CVE-2026-2041 · GHSA-qp8f-9474-hr27

OS command injection in Nagios Host

HIGH 79

Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.75586 Published 2026-02-20 No fix listed CWE-78

TI-2025-21095 CVE-2025-29471 · GHSA-v943-7xrm-g7pr

Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote…

HIGH 77

Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.07276 Published 2025-04-15 No fix listed CWE-79

TI-2025-28646 CVE-2025-44823 · GHSA-38pv-fm92-qcm4

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext…

HIGH 76

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.16882 Published 2025-10-07 Fixed in 2024R1.3.2 CWE-497

TI-2023-26026 CVE-2023-48084 · GHSA-x3mv-x599-m8pw

Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.

HIGH 74

Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.33978 Published 2023-12-14 No fix listed CWE-89

TI-2018-06305 CVE-2018-8734 · GHSA-r9pv-w7cx-x2rm

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x…

HIGH 74

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.53759 Published 2018-04-18 No fix listed CWE-89

TI-2009-02180 CVE-2009-2288 · GHSA-3j95-hrrj-gfw8

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary…

HIGH 74

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.83453 Published 2009-07-01 Fixed CWE-78

TI-2024-12991 CVE-2024-13986 · GHSA-fr8x-pm73-6f4h

Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE

HIGH 73

Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01748 Published 2025-08-28 Fixed in 2024R1.3.2 CWE-22

TI-2018-06306 CVE-2018-8735 · GHSA-44xg-hr3w-5m39

Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before…

HIGH 73

Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.63561 Published 2018-04-18 No fix listed CWE-78

TI-2021-07546 CVE-2021-25299 · GHSA-wc62-jg96-f7jf

Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS).

HIGH 72

Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.9776 Published 2021-02-15 No fix listed CWE-79

TI-2020-18084 CVE-2020-35578 · GHSA-gp5w-f9p7-f7f5

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0.

HIGH 72

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.81915 Published 2021-01-13 No fix listed CWE-78

TI-2020-04719 CVE-2020-5791 · GHSA-2j39-6c38-r3mx

OS command injection in Nagios XI

HIGH 71

Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.78632 Published 2020-10-20 No fix listed CWE-78

TI-2025-28647 CVE-2025-44824 · GHSA-mh3w-pwxw-972f

Incorrect authorization in Nagios Log Server

HIGH 70

Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.02771 Published 2025-10-07 Fixed in 2024R1.3.2 CWE-863

TI-2013-01193 CVE-2013-1362 · GHSA-cp28-pf73-xw7v

Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE)…

HIGH 70

Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by ba…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.71013 Published 2013-07-09 No fix listed CWE-20

TI-2012-05060 CVE-2012-6096 · GHSA-976m-29vc-cxx7

Multiple stack-based buffer overflows in the get_history function in history.cgi in…

HIGH 69

Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to exe…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.6645 Published 2013-01-22 No fix listed CWE-119

Open these records in search →