A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via…

The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection

A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running…

Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root

Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability

Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code

In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the…

Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job

Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users

Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request

A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root

Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command…

Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component

Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh Script

Nagios XI < 2024R2 Privilege Escalation via process_perfdata.pl

Nagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary Directory

An issue was discovered in Nagios XI 5.8.5

Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database

Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument

Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions

Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low-privileged users…

Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php

Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php

NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php

Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php

Nagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host

Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit Page

Nagios XI < 2024R1.3.2 RCE via WinRM Configuration Wizard

Nagios XI < 2026R1 RCE via Run Check Command in CCM

Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)

Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile

Nagios XI < 5.6.14 Authenticated SQL Injection via SNMP Trap Interface Page

A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute…

An issue was discovered in Nagios XI 5.8.5

An issue was discovered in Nagios XI 5.8.5

Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads…

Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component

NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0

Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code…

Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the…

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter

Nagios XI < 2011R1.9 Race Conditions in Crontab Install Scripts LPE

Nagios XI Privilege Escalation via Writable PHP Include Executed with Sudo

Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure

Nagios XI < 2012R1.6 Auto-Discovery Missing Authorization