Nagios Nagios Xi
11 CVEs affecting Nagios Nagios Xi. Latest disclosed: 2025-09-25. Critical: 1, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-15708 | Critical | 9.8 | 2018-11-14 | Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request. |
CVE-2025-34227 | High | 8.8 | 2025-09-25 | Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, a… |
CVE-2024-13986 | High | 8.8 | 2025-08-28 | Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config S… |
CVE-2021-33177 | High | 8.8 | 2021-10-14 | The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authe… |
CVE-2018-15711 | High | 8.8 | 2018-11-14 | Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key t… |
CVE-2018-15709 | High | 8.8 | 2018-11-14 | Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request. |
CVE-2018-15710 | High | 7.8 | 2018-11-14 | Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php. |
CVE-2021-33179 | Medium | 6.1 | 2021-10-14 | The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who acc… |
CVE-2018-15714 | Medium | 6.1 | 2018-11-14 | Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters. |
CVE-2018-15712 | Medium | 6.1 | 2018-11-14 | Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api_tool.php. |
CVE-2018-15713 | Medium | 5.4 | 2018-11-14 | Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php. |