Nagios XI < 5.11.3 XSS via Graph Explorer

Nagios XI < 2024R1.1.3 XSS via Executive Summary Report

Nagios XI < 5.7.2 XSS via Dashboard Background Color Setting

Nagios XI < 2024R1.0.2 XSS via Core Command Expansion

Nagios XI < 2024R1.1.3 XSS via Capacity Planning Report

Nagios XI < 5.11.3 XSS via Bulk Modifications

Nagios XI < 5.7.2 XSS via BPI Config Management

Nagios XI < 5.8.0 XSS via BPI Config ID Handling

Nagios XI < 5.11.3 XSS via Bandwidth Report

Nagios XI < 2011R1.9 XSS via backend_url JavaScript Link Handler

Nagios XI < 2011R1.9 XSS via Alert Heatmap Report & “My Reports” Listing

Nagios XI < 5.8.7 XSS in Audit Log via Send to NLS Form

Nagios XI < 5.11.3 XSS & CSRF via Hypermap Replay

Nagios XI < 5.8.9 Stored XSS via Command Names in Apply Config Error Text

Nagios XI < 5.8.9 Stored XSS via BPI Info URL

Nagios XI < 5.8.9 Stored XSS in Update Checking

Nagios XI < 5.8.0 Core Config Manager (CCM) XSS via Templates Pages

Nagios XI < 5.8.2 Core Config Manager (CCM) XSS via Services Page

Nagios XI < 5.8.8 Core Config Manager (CCM) XSS via Search & Deletion Flows

Nagios XI < 5.7.5 Core Config Manager (CCM) XSS via Overlay Rendering and Notification/Check Period Pages

Nagios XI < 5.8.2 Core Config Manager (CCM) XSS via Overlay Modals

Nagios XI < 5.7.4 Core Config Manager (CCM) XSS via Object Edit Pages

Nagios XI < 5.8.9 Core Config Manager (CCM) XSS via Audit Log Page Search Input

A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter…

A stored cross-site scripting (XSS) vulnerability in the NOC component of Nagios XI version up to and including 2024R1 allows low-privileged users to execute malicious HTML or…

A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary…

In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard

Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field)

Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent)

Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard)

Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field)

In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter

A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page

Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php

An issue was discovered in Nagios XI 5.4.13

Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server

Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Performance Settings page under the Admin panel

Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Settings page under the Admin panel

Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter

Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter

Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter

Nagios XI before 5.5.4 has XSS in the auto login admin management page

Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files

In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address