Medium severity6.1NVD Advisory· Published Oct 30, 2025· Updated Jun 17, 2026
CVE-2024-13993
CVE-2024-13993
Description
Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI origin. The issue is observable under legacy browser behaviors; modern browsers may mitigate some vectors.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7- Nagios/XIv5Range: 0
cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*range: <2024
- cpe:2.3:a:nagios:nagios_xi:2024:r1:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.0.1:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1.1:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
3- www.nagios.com/products/security/nvdVendor Advisory
- www.vulncheck.com/advisories/nagios-xi-reflected-xss-via-login-page-on-older-browsersnvdThird Party Advisory
- www.nagios.com/changelog/nagios-xi/nvdRelease Notes
News mentions
0No linked articles in our index yet.