Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Nagvis records in CISA KEVNo Nagvis vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority HIGH 72
Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php.
CVSS 3.1CRITICAL 9.1· Network · Low privileges · No interaction · EPSS 0.04135 · Published 2023-05-26 · No fix listed CWE-22
Priority MEDIUM 41
Improper neutralization of input in Nagvis before version 1.9.42 which can lead to XSS
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00532 · Published 2024-12-19 · Fixed in 1.9.42 CWE-79
Priority LOW 37
A vulnerability was found in NagVis up to 1.9.33 and classified as problematic.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.0107 · Published 2022-11-13 · No fix listed CWE-704
Priority LOW 36
User enumeration in Nagvis' Checkmk MultisiteAuth before version 1.9.48 allows an unauthenticated attacker to enumerate Checkmk usernames.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00275 · Published 2025-12-03 · Fixed in 1.9.48 CWE-203
Priority LOW 33
The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.01943 · Published 2021-10-14 · Fixed in 1.9.29 CWE-22
Priority LOW 29
An issue was discovered in NagVis 1.9b12.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00958 · Published 2017-03-02 · No fix listed CWE-79
Priority LOW 28
XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00555 · Published 2023-10-20 · No fix listed CWE-79
Priority LOW 24
Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00424 · Published 2025-05-27 · Fixed in 1.9.47 CWE-140
Priority LOW 23
Improper neutralization of input in Nagvis before version 1.9.47 which can lead to XSS
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00229 · Published 2025-05-27 · Fixed in 1.9.47 CWE-79
THREATIST.IORead the docs