Nagios XI OS Command Injection

Nagios XI OS Command Injection

Nagios XI OS Command Injection

Nagios XI Remote Code Execution Vulnerability

Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change

Nagios XI < 2024R1.2 RCE via NRDP Server Plugins

Nagios XI < 2012R1.3 Authenticated SQL Injection in Legacy CCM

Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization

Nagios XI < 2024R1.1.3 AD/LDAP Token Authenticated Information Disclosure

An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component

SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php component

Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php

Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool

Nagios XI v5.8.6 was discovered to contain a SQL injection vulnerability via the mib_name parameter at the Manage MIBs page

Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards

Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh

Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards

Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php

Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation

Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are mishandled in…

Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via…

Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code…

An issue was found in Nagios XI before 5.7.3

An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote…

Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form)

SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id

Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1…

Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and…

Nagios XI before 2024R1 was discovered to improperly handle API keys generation (randomly-generated), allowing attackers to possibly generate the same set of API keys for all…

Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability

Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability

Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability

In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability

Nagios XI < 2024R1 Web SSH Terminal Missing Access Control

Nagios XI < 5.7.2 Unrestricted File Upload via Audio Import Directory

Nagios XI < 5.2.4 SQL Injection in Notification Search

Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)

Nagios XI < 5.4.13 Component Download Page RCE

Nagios XI < 2024R1.2 Command Injection via Docker Wizard

Nagios XI < 5.7.3 Command Injection in Report PDF Download

Nagios XI < 5.7.4 Core Config Manager (CCM) SQL Injection via Object Edit Pages

Nagios XI < 5.8.5 Core Config Manager (CCM) SQL Injection via Improper Escaping in Search Text

Nagios XI < 2012R1.6 Auto-Discovery Shell Command Injection

Nagios XI < 5.6.14 Authenticated RCE command_test.php via address

Nagios XI < 2024R2 Authenticated Command Injection via WinRM Plugin

Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure

Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection

Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE

An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet