Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

192 records

Vendor: Nagios Component: Nagios Xi Clear all filters
TI-2026-01698 CVE-2026-2041 · GHSA-qp8f-9474-hr27

OS command injection in Nagios Host

Priority HIGH 79

Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.75586 Published 2026-02-20 No fix listed CWE-78
TI-2026-01700 CVE-2026-2043 · GHSA-q77w-wghg-55fv

OS command injection in Nagios Host

Priority HIGH 79

Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.75421 Published 2026-02-20 No fix listed CWE-78
TI-2026-01699 CVE-2026-2042 · GHSA-rwr9-9r33-h7x4

OS command injection in Nagios Host

Priority MEDIUM 49

Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.06075 Published 2026-02-20 No fix listed CWE-78
TI-2025-24425 CVE-2025-34288 · GHSA-2488-c4gj-6g77

Nagios XI Privilege Escalation via Writable PHP Include Executed with Sudo

Priority MEDIUM 43

Nagios XI versions prior to 2026R1.1 are vulnerable to local privilege escalation due to an unsafe interaction between sudo permissions and application file permissions.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01853 Published 2025-12-16 Fixed in 2026R1.1 CWE-732
TI-2021-22315 CVE-2021-47698 · GHSA-82fj-7wxx-cmrc

Nagios XI < 5.8.7 XSS in Core UI Views URL handling

Priority LOW 24

Nagios XI versions prior to 5.8.7 using embedded Nagios Core are vulnerable to cross-site scripting (XSS) via the Core UI’s Views URL handling (escape_string()).

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00444 Published 2025-11-03 Fixed in 5.8.7 CWE-79
TI-2024-13000 CVE-2024-13997 · GHSA-5359-gfvc-c3p7

Nagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host

Priority MEDIUM 51

Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server feature to obtain root privileges on the underlying XI host.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.0121 Published 2025-11-03 Fixed in 2024R1.1.3 CWE-269
TI-2024-13001 CVE-2024-13998 · GHSA-2mr3-pj2m-q569

Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure

Priority LOW 29

Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.0104 Published 2025-11-03 Fixed in 2024R1.1.3 CWE-497
TI-2024-12995 CVE-2024-13992 · GHSA-4fg8-97vg-f94j

Nagios XI < 2024R1.1 XSS via Missing Page / 404

Priority LOW 24

Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00587 Published 2025-10-31 Fixed in 2024R1.1 CWE-79
TI-2011-04639 CVE-2011-10037 · GHSA-8pr9-vvj4-gx32

Nagios XI < 2011R1.9 XSS via xiwindow Variables Affecting Permalinks

Priority MEDIUM 56

Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of xiwindow variables used to build permalinks in the web interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00607 Published 2025-10-30 Fixed in 2011R1.9 CWE-79
TI-2021-22314 CVE-2021-47697 · GHSA-v6f7-ffvc-p9q8

Nagios XI < 5.8.0 XSS via Views URL Handling

Priority LOW 24

Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via the Views feature URL handling.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00446 Published 2025-10-30 Fixed in 5.8.0 CWE-79
TI-2018-15347 CVE-2018-25121 · GHSA-6p96-4pr7-737x

Nagios XI < 5.4.13 XSS via Views Page

Priority LOW 24

Nagios XI versions prior to 5.4.13 are vulnerable to cross-site scripting (XSS) via the Views page of the web interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0042 Published 2025-10-30 Fixed in 5.4.13 CWE-79
TI-2013-06214 CVE-2013-10074 · GHSA-6pgf-38g2-8c2h

Nagios XI < 2012R2.6 XSS via Tools Menu

Priority LOW 24

Nagios XI versions prior to 2012R2.6 are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0042 Published 2025-10-30 Fixed in 2012R2.6 CWE-79
TI-2011-04642 CVE-2011-10040 · GHSA-vqcj-w8vp-2m7x

Nagios XI < 2011R1.9 XSS via Status/Report Page Link Functions

Priority LOW 24

Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the link-handling functions used by status and report pages.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00444 Published 2025-10-30 Fixed in 2011R1.9 CWE-79
TI-2016-09171 CVE-2016-15051 · GHSA-vw36-82p7-rrqj

Nagios XI < 5.2.4 XSS via Report startdate/enddate Fields

Priority LOW 24

Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Reports interface through values from the startdate and enddate fields.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0042 Published 2025-10-30 Fixed in 5.2.4 CWE-79
TI-2011-04640 CVE-2011-10038 · GHSA-vxgw-44xc-h6c6

Nagios XI < 2011R1.9 XSS via Recurring Downtime Script

Priority LOW 24

Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the recurring downtime script of the web interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00472 Published 2025-10-30 Fixed in 2011R1.9 CWE-79
TI-2021-22312 CVE-2021-47695 · GHSA-94gv-43w2-9f3r

Nagios XI < 5.8.0 XSS via My Tools Page

Priority LOW 24

Nagios XI versions prior to 5.8.0 are vulnerable to stored cross-site scripting (XSS) via the My Tools page.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00446 Published 2025-10-30 Fixed in 5.8.0 CWE-79
TI-2016-09173 CVE-2016-15053 · GHSA-2mqf-crhf-c264

Nagios XI < 5.2.4 XSS via “My Reports” Listing

Priority LOW 24

Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the “My Reports” listing of the web interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00446 Published 2025-10-30 Fixed in 5.2.4 CWE-79
TI-2016-09172 CVE-2016-15052 · GHSA-m82p-4hfp-2w2f

Nagios XI < 5.2.4 XSS via Menu System

Priority LOW 24

Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Menu System of the web interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00446 Published 2025-10-30 Fixed in 5.2.4 CWE-79
TI-2020-19001 CVE-2020-36866 · GHSA-c8w5-3w25-7r9c

Nagios XI < 5.7.3 XSS via Manage Users in Admin Interface

Priority LOW 24

Nagios XI versions prior to 5.7.3 are vulnerable to cross-site scripting (XSS) via the Manage Users page of the Admin interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0042 Published 2025-10-30 Fixed in 5.7.3 CWE-79
TI-2023-06683 CVE-2023-7316 · GHSA-rqrg-cx67-rw63

Nagios XI < 2024R1 XSS via Graph Explorer

Priority LOW 24

Nagios XI versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00587 Published 2025-10-30 Fixed in 2024R1 CWE-79
TI-2023-06682 CVE-2023-7315 · GHSA-cvh9-3mpx-5p4r

Nagios XI < 5.11.3 XSS via Graph Explorer

Priority LOW 24

Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00513 Published 2025-10-30 Fixed in 5.11.3 CWE-79
TI-2024-13004 CVE-2024-14001 · GHSA-42h4-7cw5-mjmj

Nagios XI < 2024R1.1.3 XSS via Executive Summary Report

Priority LOW 24

Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Executive Summary Report component.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00587 Published 2025-10-30 Fixed in 2024R1.1.3 CWE-79
TI-2020-18999 CVE-2020-36864 · GHSA-gp22-rwrg-w6qp

Nagios XI < 5.7.2 XSS via Dashboard Background Color Setting

Priority LOW 24

Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the background color settings in Dashboards.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00446 Published 2025-10-30 Fixed in 5.7.2 CWE-79
Load more