Nagios

Records303All Threatist records

Exploited (KEV)4In CISA KEV

CVSS critical52CVSS 9.0–10.0

CVSS high102CVSS 7.0–8.9

Exploited now

Nagios records in CISA KEV

TI-2021-07543 Nagios XI OS Command Injection CRITICAL 97KEV 2022-01-18 TI-2021-07544 Nagios XI OS Command Injection CRITICAL 97KEV 2022-01-18 TI-2021-07545 Nagios XI OS Command Injection CRITICAL 97KEV 2022-01-18 TI-2019-11993 Nagios XI Remote Code Execution Vulnerability CRITICAL 97KEV 2021-11-03

Components

Products in the NVD configurations · select one to filter the records

Nagios Xi 192 records CRITICAL Nagios 37 records HIGH Log Server 23 records HIGH Fusion 19 records MEDIUM Network Analyzer 7 records MEDIUM Nagios Core 5 records MEDIUM Incident Manager 3 records MEDIUM Plugins 3 records MEDIUM

Records

192 records in Nagios Xi · all components

TI-2021-07545 CVE-2021-25298 · GHSA-6gq5-wx57-577c

Nagios XI version xi-5.7.5 is affected by OS command injection.

CRITICAL 97KEV

Nagios XI version xi-5.7.5 is affected by OS command injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.73641 Published 2021-02-15 No fix listed CWE-78

TI-2021-07544 CVE-2021-25297 · GHSA-5924-w244-8fxp

Nagios XI version xi-5.7.5 is affected by OS command injection.

CRITICAL 97KEV

Nagios XI version xi-5.7.5 is affected by OS command injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.56659 Published 2021-02-15 No fix listed CWE-78

TI-2021-07543 CVE-2021-25296 · GHSA-8hgr-54hv-7pgc

Nagios XI version xi-5.7.5 is affected by OS command injection.

CRITICAL 97KEV

Nagios XI version xi-5.7.5 is affected by OS command injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.71935 Published 2021-02-15 No fix listed

TI-2019-11993 CVE-2019-15949 · GHSA-8qv6-943v-r8gm

Nagios XI before 5.6.6 allows remote command execution as root.

CRITICAL 97KEV

Nagios XI before 5.6.6 allows remote command execution as root.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.77039 Published 2019-09-05 No fix listed CWE-78

TI-2023-26027 CVE-2023-48085 · GHSA-v8x2-pmhm-gqcj

Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE)…

CRITICAL 88

Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.75844 Published 2023-12-14 No fix listed CWE-94

TI-2018-11196 CVE-2018-15708 · GHSA-mxhr-3xg4-5hx7

Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute…

CRITICAL 85

Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.89362 Published 2018-11-14 No fix listed

TI-2024-16107 CVE-2024-24401 · GHSA-73wx-63h7-3wh6

SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute…

HIGH 82

SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.45884 Published 2024-02-26 No fix listed CWE-89

TI-2021-15319 CVE-2021-37350 · GHSA-h349-h9cf-xhfx

Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk…

HIGH 82

Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.7925 Published 2021-08-13 No fix listed CWE-89

TI-2026-01700 CVE-2026-2043 · GHSA-q77w-wghg-55fv

OS command injection in Nagios Host

HIGH 79

Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.75421 Published 2026-02-20 No fix listed CWE-78

TI-2026-01698 CVE-2026-2041 · GHSA-qp8f-9474-hr27

OS command injection in Nagios Host

HIGH 79

Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.75586 Published 2026-02-20 No fix listed CWE-78

TI-2023-26026 CVE-2023-48084 · GHSA-x3mv-x599-m8pw

Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.

HIGH 74

Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.33978 Published 2023-12-14 No fix listed CWE-89

TI-2018-06305 CVE-2018-8734 · GHSA-r9pv-w7cx-x2rm

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x…

HIGH 74

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.53759 Published 2018-04-18 No fix listed CWE-89

TI-2024-12991 CVE-2024-13986 · GHSA-fr8x-pm73-6f4h

Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE

HIGH 73

Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01748 Published 2025-08-28 Fixed in 2024R1.3.2 CWE-22

TI-2018-06306 CVE-2018-8735 · GHSA-44xg-hr3w-5m39

Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before…

HIGH 73

Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.63561 Published 2018-04-18 No fix listed CWE-78

TI-2021-07546 CVE-2021-25299 · GHSA-wc62-jg96-f7jf

Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS).

HIGH 72

Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.9776 Published 2021-02-15 No fix listed CWE-79

TI-2020-18084 CVE-2020-35578 · GHSA-gp5w-f9p7-f7f5

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0.

HIGH 72

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.81915 Published 2021-01-13 No fix listed CWE-78

TI-2020-04719 CVE-2020-5791 · GHSA-2j39-6c38-r3mx

OS command injection in Nagios XI

HIGH 71

Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.78632 Published 2020-10-20 No fix listed CWE-78

TI-2021-15836 CVE-2021-38156 · GHSA-2cr4-q4vr-2q6r

In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when…

HIGH 68

In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.92909 Published 2021-09-15 No fix listed CWE-79

TI-2019-06627 CVE-2019-9164 · GHSA-cvv6-3m9w-p3gc

Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute…

HIGH 68

Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.45972 Published 2019-03-28 No fix listed CWE-79

TI-2018-06307 CVE-2018-8736 · GHSA-68w8-rgj6-2jm9

A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13…

HIGH 68

A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.45628 Published 2018-04-18 No fix listed

TI-2021-17416 CVE-2021-40344 · GHSA-r8gx-p4rw-3vpj

An issue was discovered in Nagios XI 5.8.5.

HIGH 67

An issue was discovered in Nagios XI 5.8.5.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.64804 Published 2021-10-26 No fix listed CWE-434

TI-2020-17022 CVE-2020-27988 · GHSA-v9r7-v567-9p2v

Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).

HIGH 67

Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.91311 Published 2020-11-16 No fix listed CWE-79

TI-2020-04720 CVE-2020-5792 · GHSA-4w5r-xgqv-25rr

Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a…

HIGH 67

Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.63544 Published 2020-10-20 No fix listed CWE-88

TI-2021-02296 CVE-2021-3277 · GHSA-xj6h-r3q8-7cmf

Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to…

HIGH 66

Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.59023 Published 2021-06-07 No fix listed CWE-434

TI-2018-11199 CVE-2018-15711 · GHSA-w945-wc2v-qq8w

OS command injection in Nagios XI

MEDIUM 64

Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.36012 Published 2018-11-14 No fix listed CWE-78

Open these records in search →