What is CVE-2012-10063?

CVE-2012-10063 is a critical-severity vulnerability in Nagios Xi, classified under SQL Injection. CVSS score: 9.8/10. Published 2025-10-30.

How severe is CVE-2012-10063?

Critical severity. CVSS v3 base score is 9.8 out of 10.

SQL Injection in Nagios Xi

CVE-2012-10063

Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database. Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.

Vulnerability class: SQL Injection

EPSS: 0.010 (60.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Nagios Nagios_xi — versions 2012
Nagios Xi — versions 0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

disclosure@vulncheck.com (release-notes, Release Notes, patch)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2012-10063?: CVE-2012-10063 is a critical-severity vulnerability in Nagios Xi, classified under SQL Injection. CVSS score: 9.8/10. Published 2025-10-30.
How severe is CVE-2012-10063?: Critical severity. CVSS v3 base score is 9.8 out of 10.