Nagios
by Nagios
Source repositories
CVEs (169)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-6209 | Med | 0.40 | 6.1 | 0.02 | Mar 31, 2017 | Cross-site scripting (XSS) vulnerability in Nagios. | ||
| CVE-2018-13441 | Med | 0.39 | 5.5 | 0.01 | Jul 12, 2018 | qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket. | ||
| CVE-2020-27990 | Med | 0.37 | 5.4 | 0.34 | Nov 16, 2020 | Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent). | ||
| CVE-2020-27989 | Med | 0.37 | 5.4 | 0.34 | Nov 16, 2020 | Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard). | ||
| CVE-2020-10821 | Med | 0.37 | 4.8 | 0.71 | Mar 22, 2020 | Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter. | ||
| CVE-2020-10819 | Med | 0.37 | 4.8 | 0.71 | Mar 22, 2020 | Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter. | ||
| CVE-2020-6586 | Med | 0.37 | 5.4 | 0.19 | Mar 16, 2020 | Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered. | ||
| CVE-2019-3698 | Med | 0.37 | 5.7 | 0.01 | Feb 28, 2020 | UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This… | ||
| CVE-2024-14002 | Med | 0.36 | 5.5 | 0.01 | Oct 30, 2025 | Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the… | ||
| CVE-2018-15713 | Med | 0.36 | 5.4 | 0.07 | Nov 14, 2018 | Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php. | ||
| CVE-2021-47698 | Med | 0.35 | 5.4 | 0.00 | Nov 3, 2025 | Nagios XI versions prior to 5.8.7 using embedded Nagios Core are vulnerable to cross-site scripting (XSS) via the Core UI’s Views URL handling (escape_string()). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary… | ||
| CVE-2024-13992 | Med | 0.35 | 5.4 | 0.01 | Oct 31, 2025 | Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website. The vulnerable component, page-missing.php, fails to properly validate or escape user-supplied… | ||
| CVE-2023-7318 | Med | 0.35 | 5.4 | 0.01 | Oct 30, 2025 | Nagios XI versions prior to < 2024R1.0.2 are vulnerable to cross-site scripting (XSS) via the Nagios Core Command Expansion page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's… | ||
| CVE-2023-7316 | Med | 0.35 | 5.4 | 0.01 | Oct 30, 2025 | Nagios XI versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. | ||
| CVE-2023-7315 | Med | 0.35 | 5.4 | 0.00 | Oct 30, 2025 | Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. | ||
| CVE-2023-7314 | Med | 0.35 | 5.4 | 0.00 | Oct 30, 2025 | Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. | ||
| CVE-2023-53688 | Med | 0.35 | 5.4 | 0.00 | Oct 30, 2025 | Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) and cross-site request forgery (CSRF) via the Hypermap Replay component. An attacker can submit crafted input that is not properly validated or escaped, allowing injection of malicious script that… | ||
| CVE-2022-50588 | Med | 0.35 | 5.4 | 0.00 | Oct 30, 2025 | Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the update checking feature. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. | ||
| CVE-2022-50586 | Med | 0.35 | 5.4 | 0.00 | Oct 30, 2025 | Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the BPI component via the info URL field. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's… | ||
| CVE-2022-50585 | Med | 0.35 | 5.4 | 0.00 | Oct 30, 2025 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.7 / Nagios XI 5.8.9 contains a cross-site scripting (XSS) vulnerability via the Audit Log page search input. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and… |
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in Nagios.
- risk 0.39cvss 5.5epss 0.01
qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.
- risk 0.37cvss 5.4epss 0.34
Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).
- risk 0.37cvss 5.4epss 0.34
Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).
- risk 0.37cvss 4.8epss 0.71
Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.
- risk 0.37cvss 4.8epss 0.71
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.
- risk 0.37cvss 5.4epss 0.19
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered.
- risk 0.37cvss 5.7epss 0.01
UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This…
- risk 0.36cvss 5.5epss 0.01
Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the…
- risk 0.36cvss 5.4epss 0.07
Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.
- risk 0.35cvss 5.4epss 0.00
Nagios XI versions prior to 5.8.7 using embedded Nagios Core are vulnerable to cross-site scripting (XSS) via the Core UI’s Views URL handling (escape_string()). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary…
- risk 0.35cvss 5.4epss 0.01
Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website. The vulnerable component, page-missing.php, fails to properly validate or escape user-supplied…
- risk 0.35cvss 5.4epss 0.01
Nagios XI versions prior to < 2024R1.0.2 are vulnerable to cross-site scripting (XSS) via the Nagios Core Command Expansion page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's…
- risk 0.35cvss 5.4epss 0.01
Nagios XI versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- risk 0.35cvss 5.4epss 0.00
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- risk 0.35cvss 5.4epss 0.00
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- risk 0.35cvss 5.4epss 0.00
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) and cross-site request forgery (CSRF) via the Hypermap Replay component. An attacker can submit crafted input that is not properly validated or escaped, allowing injection of malicious script that…
- risk 0.35cvss 5.4epss 0.00
Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the update checking feature. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- risk 0.35cvss 5.4epss 0.00
Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the BPI component via the info URL field. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's…
- risk 0.35cvss 5.4epss 0.00
The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.7 / Nagios XI 5.8.9 contains a cross-site scripting (XSS) vulnerability via the Audit Log page search input. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and…
Page 6 of 9