Nagios XI Privilege Escalation via Writable PHP Include Executed with Sudo

Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure

Nagios XI < 2012R1.6 Auto-Discovery Missing Authorization

Nagios XI < 2024R1.4.2 API Key Disclosure via Neptune Themes

Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and email addresses of all…

A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History Tab component

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in…

In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime for any host/services

In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformatting/editing of emails from an official…

Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php

Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link

An issue was discovered in Nagios XI 5.4.13

Nagios XI < 5.6.11 Unauthenticated XSS and SSRF via Highcharts

Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older Browsers

Nagios XI < 2012R1.6 Reflected XSS via Dashlet AJAX Load Functionality

Nagios XI < 2024R1.2.2 Host Header Injection

Nagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test Command

A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2

Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions

Nagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-Site Scripting (XSS)

Nagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page

Cross Site Scripting (XSS) in Nagios XI 5.7.1 allows remote attackers to run arbitrary code via returnUrl parameter in a crafted GET request

Nagios XI before v5.8.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the ajax.php script in CCM 3.1.5

Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the MTR component in version 1.0.4

Nagios XI before v5.8.7 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at auditlog.php

In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing

The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting

An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing

Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS)

Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option

Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow parameter

An issue was discovered in Nagios XI before 5.5.8

An issue was discovered in Nagios XI before 5.5.8

Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters

Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api_tool.php

Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVis

Nagios XI < 5.8.7 XSS in Core UI Views URL handling

Nagios XI < 2024R1.1 XSS via Missing Page / 404

Nagios XI < 2011R1.9 XSS via xiwindow Variables Affecting Permalinks

Nagios XI < 5.8.0 XSS via Views URL Handling

Nagios XI < 5.4.13 XSS via Views Page

Nagios XI < 2012R2.6 XSS via Tools Menu

Nagios XI < 2011R1.9 XSS via Status/Report Page Link Functions

Nagios XI < 5.2.4 XSS via Report startdate/enddate Fields

Nagios XI < 2011R1.9 XSS via Recurring Downtime Script

Nagios XI < 5.8.0 XSS via My Tools Page

Nagios XI < 5.2.4 XSS via “My Reports” Listing

Nagios XI < 5.2.4 XSS via Menu System

Nagios XI < 5.7.3 XSS via Manage Users in Admin Interface

Nagios XI < 2024R1 XSS via Graph Explorer