What is CVE-2016-15050?

CVE-2016-15050 is a high-severity vulnerability in Nagios Xi, classified under SQL Injection. CVSS score: 8.8/10. Published 2025-10-30.

How severe is CVE-2016-15050?

High severity. CVSS v3 base score is 8.8 out of 10.

SQL Injection in Nagios Xi

CVE-2016-15050

Nagios XI versions prior to 5.2.4 contain a SQL injection vulnerability in the notification search functionality. User-supplied search parameters were incorporated into SQL statements without adequate parameterization or sanitation, allowing an authenticated user to manipulate database queries. Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.

Vulnerability class: SQL Injection

EPSS: 0.010 (60.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Nagios Nagios_xi
Nagios Xi — versions 0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

disclosure@vulncheck.com (release-notes, Release Notes, patch)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2016-15050?: CVE-2016-15050 is a high-severity vulnerability in Nagios Xi, classified under SQL Injection. CVSS score: 8.8/10. Published 2025-10-30.
How severe is CVE-2016-15050?: High severity. CVSS v3 base score is 8.8 out of 10.