Nagios XI OS Command Injection

Nagios XI OS Command Injection

Nagios XI OS Command Injection

Nagios XI Remote Code Execution Vulnerability

Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability

Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability

Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability

In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability

Nagios XI < 2024R1 Web SSH Terminal Missing Access Control

Nagios XI < 5.7.2 Unrestricted File Upload via Audio Import Directory

Nagios XI < 5.2.4 SQL Injection in Notification Search

Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)

Nagios XI < 5.4.13 Component Download Page RCE

Nagios XI < 2024R1.2 Command Injection via Docker Wizard

Nagios XI < 5.7.3 Command Injection in Report PDF Download

Nagios XI < 5.7.4 Core Config Manager (CCM) SQL Injection via Object Edit Pages

Nagios XI < 5.8.5 Core Config Manager (CCM) SQL Injection via Improper Escaping in Search Text

Nagios XI < 2012R1.6 Auto-Discovery Shell Command Injection

Nagios XI < 5.6.14 Authenticated RCE command_test.php via address

Nagios XI < 2024R2 Authenticated Command Injection via WinRM Plugin

Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure

Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection

Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE

An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet

A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via…

The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection

A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running…

Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root

Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability

Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code

In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the…

Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job

Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users

Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request

A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root

Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command…

Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component

Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh Script

Nagios XI < 2024R2 Privilege Escalation via process_perfdata.pl

Nagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary Directory

An issue was discovered in Nagios XI 5.8.5

Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database

Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument

Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions

Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low-privileged users…

Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php

Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php

NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php

Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php