Nagios
Page 2 of 4 — Nagios CVEs from a corpus of 301, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2011-10040 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the link-handling functions used by status and report pages. Insufficient… |
CVE-2011-10039 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the Alert Heatmap report and the “My Reports” listing of the web interfac… |
CVE-2011-10038 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the recurring downtime script of the web interface. Insufficient validati… |
CVE-2011-10037 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of xiwindow variables used to build permalinks in the web in… |
CVE-2011-10036 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of the "backend_url" JavaScript link. Insufficient validatio… |
CVE-2011-10035 | High | 7.0 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 contain privilege escalation vulnerabilities in the scripts that install or update system crontab entries. Due to time-of-… |
CVE-2025-60425 | High | 8.6 | 2025-10-27 | Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attac… |
CVE-2025-60424 | High | 7.6 | 2025-10-27 | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce att… |
CVE-2025-44824 | High | 8.5 | 2025-10-07 | Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/a… |
CVE-2025-44823 | Critical | 9.9 | 2025-10-07 | Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_us… |
CVE-2025-34227 | High | 8.8 | 2025-09-25 | Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, a… |
CVE-2024-13986 | High | 8.8 | 2025-08-28 | Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config S… |
CVE-2025-56432 | Medium | 6.1 | 2025-08-26 | A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context… |
CVE-2025-28059 | High | 7.5 | 2025-04-18 | An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalid… |
CVE-2025-29471 | High | 8.3 | 2025-04-15 | Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field. |
CVE-2025-28132 | Medium | 4.6 | 2025-04-01 | A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized… |
CVE-2025-28131 | Medium | 4.6 | 2025-04-01 | A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative action… |
CVE-2024-54957 | Medium | 6.1 | 2025-02-27 | Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions. This vulnerability allows an at… |
CVE-2024-54961 | Medium | 6.5 | 2025-02-20 | Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and emai… |
CVE-2024-54960 | Medium | 6.5 | 2025-02-20 | A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History Tab component. |
CVE-2024-54959 | Medium | 6.1 | 2025-02-20 | Nagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-Site Scripting (XSS… |
CVE-2024-54958 | Medium | 6.1 | 2025-02-20 | Nagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. This flaw allows an attacker to inject malicious sc… |
CVE-2024-42898 | Medium | 5.4 | 2025-01-09 | A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected int… |
CVE-2023-48082 | Critical | 9.1 | 2024-10-14 | Nagios XI before 2024R1 was discovered to improperly handle API keys generation (randomly-generated), allowing attackers to possibly generate the same set of A… |
CVE-2024-43199 | High | 7.8 | 2024-08-07 | Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user. |
CVE-2024-33775 | Critical | 9.8 | 2024-05-01 | An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet. |
CVE-2024-24402 | Critical | 9.8 | 2024-02-26 | An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component. |
CVE-2024-24401 | Critical | 9.8 | 2024-02-26 | SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php compone… |
CVE-2023-51072 | Medium | 5.4 | 2024-02-02 | A stored cross-site scripting (XSS) vulnerability in the NOC component of Nagios XI version up to and including 2024R1 allows low-privileged users to execute m… |
CVE-2021-43584 | Medium | 4.8 | 2024-01-24 | DOM-based Cross Site Scripting (XSS vulnerability in 'Tail Event Logs' functionality in Nagios Nagios Cross-Platform Agent (NCPA) before 2.4.0 allows attackers… |
CVE-2023-48085 | Critical | 9.8 | 2023-12-14 | Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php. |
CVE-2023-48084 | Critical | 9.8 | 2023-12-14 | Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool. |
CVE-2023-40934 | High | 7.2 | 2023-09-19 | A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration… |
CVE-2023-40933 | High | 8.8 | 2023-09-19 | A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitr… |
CVE-2023-40932 | Medium | 5.4 | 2023-09-19 | A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inj… |
CVE-2023-40931 | Medium | 6.5 | 2023-09-19 | A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via… |
CVE-2020-23992 | Medium | 6.1 | 2023-08-22 | Cross Site Scripting (XSS) in Nagios XI 5.7.1 allows remote attackers to run arbitrary code via returnUrl parameter in a crafted GET request. |
CVE-2021-4285 | Low | 3.5 | 2022-12-27 | A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templates/tail.html. The… |
CVE-2022-38254 | Medium | 6.1 | 2022-09-07 | Nagios XI before v5.8.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the ajax.php script in CCM 3.1.5. |
CVE-2022-38251 | Medium | 4.8 | 2022-09-07 | Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Performance Settings page under the Admin panel. |
CVE-2022-38250 | Critical | 9.8 | 2022-09-07 | Nagios XI v5.8.6 was discovered to contain a SQL injection vulnerability via the mib_name parameter at the Manage MIBs page. |
CVE-2022-38249 | Medium | 6.1 | 2022-09-07 | Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the MTR component in version 1.0.4. |
CVE-2022-38248 | Medium | 6.1 | 2022-09-07 | Nagios XI before v5.8.7 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at auditlog.php. |
CVE-2022-38247 | Medium | 4.8 | 2022-09-07 | Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Settings page under the Admin panel. |
CVE-2022-29272 | Medium | 6.1 | 2022-06-29 | In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing. |
CVE-2022-29271 | Medium | 6.5 | 2022-06-29 | In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime for any host/services. This allows an a… |
CVE-2022-29270 | Medium | 4.3 | 2022-06-29 | In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address. |
CVE-2022-29269 | Medium | 6.5 | 2022-06-29 | In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformatting/editing of ema… |
CVE-2021-40345 | High | 7.2 | 2021-10-26 | An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can upload ZIP files. A command injection (with… |
CVE-2021-40344 | High | 7.2 | 2021-10-26 | An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as l… |
CVE-2021-40343 | High | 7.8 | 2021-10-26 | An issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios user to elevate their privileges to the… |
CVE-2021-33179 | Medium | 6.1 | 2021-10-14 | The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who acc… |
CVE-2021-33177 | High | 8.8 | 2021-10-14 | The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authe… |
CVE-2021-37223 | Medium | 6.5 | 2021-10-05 | Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create sched… |
CVE-2021-36366 | Critical | 9.8 | 2021-09-28 | Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards. |
CVE-2021-36365 | Critical | 9.8 | 2021-09-28 | Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh. |
CVE-2021-36364 | Critical | 9.8 | 2021-09-28 | Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards. |
CVE-2021-36363 | Critical | 9.8 | 2021-09-28 | Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php. |
CVE-2021-38156 | Medium | 5.4 | 2021-09-15 | In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard. |
CVE-2021-37353 | Critical | 9.8 | 2021-08-13 | Nagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table_population.php. |
CVE-2021-37352 | Medium | 6.1 | 2021-08-13 | An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability, an attacker could send a lin… |
CVE-2021-37351 | Medium | 5.3 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to… |
CVE-2021-37350 | Critical | 9.8 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation. |
CVE-2021-37349 | High | 7.8 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database. |
CVE-2021-37348 | High | 7.5 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php. |
CVE-2021-37347 | High | 7.8 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argumen… |
CVE-2021-37346 | Critical | 9.8 | 2021-08-13 | Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Comma… |
CVE-2021-37345 | High | 7.8 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with el… |
CVE-2021-37344 | Critical | 9.8 | 2021-08-13 | Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (… |
CVE-2021-37343 | High | 8.8 | 2021-08-13 | A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context… |
CVE-2021-35479 | Medium | 5.4 | 2021-07-30 | Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. Th… |
CVE-2021-35478 | Medium | 5.4 | 2021-07-30 | Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are a… |
CVE-2021-3277 | High | 7.2 | 2021-06-07 | Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes com… |
CVE-2020-28911 | Medium | 6.5 | 2021-05-24 | Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the… |
CVE-2020-28910 | Critical | 9.8 | 2021-05-24 | Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are… |
CVE-2020-28909 | High | 8.8 | 2021-05-24 | Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are abl… |
CVE-2020-28908 | Critical | 9.8 | 2021-05-24 | Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios. |
CVE-2020-28907 | Critical | 9.8 | 2021-05-24 | Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to do… |
CVE-2020-28906 | High | 8.8 | 2021-05-24 | Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are… |
CVE-2020-28905 | High | 8.8 | 2021-05-24 | Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination. |
CVE-2020-28904 | Critical | 9.8 | 2021-05-24 | Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component co… |
CVE-2020-28903 | Medium | 6.1 | 2021-05-24 | Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS. |
CVE-2020-28902 | Critical | 9.8 | 2021-05-24 | Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php. |
CVE-2020-28901 | Critical | 9.8 | 2021-05-24 | Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component install… |
CVE-2020-28900 | Critical | 9.8 | 2021-05-24 | Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code E… |
CVE-2021-28925 | Critical | 9.8 | 2021-04-08 | SQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o[col] parameter to api/checks/read/. |
CVE-2021-28924 | Medium | 6.1 | 2021-04-08 | Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page. |
CVE-2021-3273 | High | 7.2 | 2021-02-25 | Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admi… |
CVE-2020-24899 | High | 8.8 | 2021-02-15 | Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query. |
CVE-2020-22427 | High | 7.2 | 2021-02-15 | NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. An authenticated nagiosadmin user can inject additional commands into a request. NO… |
CVE-2021-25299 | Medium | 6.1 | 2021-02-15 | Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to im… |
CVE-2021-25298 | High | 8.8 | 2021-02-15 | Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/c… |
CVE-2021-25297 | High | 8.8 | 2021-02-15 | Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/swi… |
CVE-2021-25296 | High | 8.8 | 2021-02-15 | Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi… |
CVE-2021-26024 | Medium | 5.3 | 2021-02-03 | The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other us… |
CVE-2021-26023 | Medium | 6.1 | 2021-02-03 | The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS. |
CVE-2021-3193 | Critical | 9.8 | 2021-01-26 | Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to… |
CVE-2020-25385 | Medium | 6.1 | 2021-01-20 | Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter… |
CVE-2020-35578 | High | 7.2 | 2021-01-13 | An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload… |
CVE-2020-35269 | High | 8.8 | 2020-12-23 | Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or serve… |