Vulnerabilities

TI-2026-28235 CVE-2026-38968 · GHSA-5rrm-76q9-hp77

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to…

MEDIUM 50

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00553 Published 2026-07-02 No fix listed CWE-341

TI-2018-08982 CVE-2018-12520 · GHSA-mx87-47cg-9wpg

An issue was discovered in ntopng 3.4 before 3.4.180617.

MEDIUM 48

An issue was discovered in ntopng 3.4 before 3.4.180617.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.10542 Published 2018-07-05 No fix listed CWE-335

TI-2017-05107 CVE-2017-7458 · GHSA-4qmq-73jf-8wvj

The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0…

LOW 37

The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty field that should hav…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01854 Published 2017-06-26 No fix listed CWE-476

TI-2017-05108 CVE-2017-7459 · GHSA-55f4-wx4x-65x3

ntopng before 3.0 allows HTTP Response Splitting.

LOW 34

ntopng before 3.0 allows HTTP Response Splitting.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00866 Published 2017-06-26 No fix listed CWE-74

TI-2017-05069 CVE-2017-7416 · GHSA-3x73-p3qx-cwqw

ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated.

LOW 28

ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00631 Published 2017-06-26 No fix listed CWE-79

TI-2017-03496 CVE-2017-5473 · GHSA-5qh4-jjjw-xg4h

Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote…

MEDIUM 44

Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by admin/add_user.lua, admin/change_user_prefs.lua, admin/del…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.03525 Published 2017-01-14 No fix listed CWE-352

TI-2015-06889 CVE-2015-8368 · GHSA-h398-48h8-5rg7

ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login…

LOW 35

ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/password_reset.lua.

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.05099 Published 2015-12-17 No fix listed CWE-254

TI-2014-04461 CVE-2014-5464 · GHSA-7fxh-4w9w-83v2

Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in…

LOW 27

Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04454 Published 2014-09-08 No fix listed CWE-79

TI-2014-03540 CVE-2014-4329 · GHSA-w6r4-8qxx-p87q

Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows…

LOW 23

Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01233 Published 2014-06-19 No fix listed CWE-79

Vulnerabilities

Filters