Nagios Xi vulnerabilities

CVE-2021-25299 [MEDIUM] CWE-79 CVE-2021-25299: Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in th Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs

CVE-2018-15710 [HIGH] CWE-78 CVE-2018-15710: Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.

CVE-2018-10738 [HIGH] CWE-89 CVE-2018-10738: A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter.

CVE-2023-48085 [CRITICAL] CWE-94 CVE-2023-48085: Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerabilit Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php.

CVE-2021-38156 [MEDIUM] CWE-79 CVE-2021-38156: In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative user In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.

CVE-2021-37350 [CRITICAL] CWE-89 CVE-2021-37350: Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications To Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.

CVE-2019-12279 [CRITICAL] CWE-89 CVE-2019-12279: Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the res Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while t

CVE-2023-40931 [MEDIUM] CWE-89 CVE-2023-40931: A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows aut A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php

CVE-2026-2042 [HIGH] CWE-78 CVE-2026-2042: Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability. This vulnerabili Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability. The specific flaw exists within the monitoringwizard module. The issue results from the lack of proper

CVE-2019-9164 [HIGH] CWE-79 CVE-2019-9164: Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remo Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.

CVE-2025-34227 [HIGH] CWE-78 CVE-2025-34227: Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the Mong Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.

CVE-2018-15711 [HIGH] CWE-78 CVE-2018-15711: Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more pr Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges.

CVE-2024-14003 [CRITICAL] CWE-78 CVE-2024-14003: Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins. Insufficient validation of inbound NRDP request parameters allows crafted input to reach command execution paths, enabling attackers to execute arbitrary commands on the underlying host in the context of

CVE-2021-40344 [HIGH] CWE-434 CVE-2021-40344: An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an ad An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution.

CVE-2021-3193 [CRITICAL] CVE-2021-3193: Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in N Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.

CVE-2013-6875 [HIGH] CWE-89 CVE-2013-6875: SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php.

CVE-2021-3277 [HIGH] CWE-434 CVE-2021-3277: Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper va Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.

CVE-2020-15901 [HIGH] CVE-2020-15901: In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.

CVE-2018-15709 [HIGH] CWE-78 CVE-2018-15709: Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HT Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request.

CVE-2020-24899 [HIGH] CWE-78 CVE-2020-24899: Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user ca Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query.