# Nagios XI.

Every CVE that names Nagios XI among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [An issue was discovered in Nagios XI before 5.9.3.](https://agentprime.io/advisories/CVE-2023-24035.md)
  `CVE-2023-24035` · CVE record: Nagios Nagios XI · CVSS 3.5 Low · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-208
- [Open redirect in Nagios XI](https://agentprime.io/advisories/CVE-2023-24034.md)
  `CVE-2023-24034` · CVE record: Nagios Nagios XI · CVSS 3.1 Low · Not analysed yet · Published 14 Sept 2026 · Tags: Open redirect
- [Nagios XI < 5.8.7 XSS in Core UI Views URL handling](https://agentprime.io/advisories/CVE-2021-47698.md)
  `CVE-2021-47698` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host](https://agentprime.io/advisories/CVE-2024-13997.md)
  `CVE-2024-13997` · CVE record: Nagios XI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2025 · Tags: Privilege escalation
- [Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure](https://agentprime.io/advisories/CVE-2024-13998.md)
  `CVE-2024-13998` · CVE record: Nagios XI · CVSS 6.0 Medium · Not analysed yet · Published 3 Nov 2025 · Tags: Information disclosure
- [Nagios XI < 2024R1.1 XSS via Missing Page / 404](https://agentprime.io/advisories/CVE-2024-13992.md)
  `CVE-2024-13992` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 31 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 2011R1.9 XSS via xiwindow Variables Affecting Permalinks](https://agentprime.io/advisories/CVE-2011-10037.md)
  `CVE-2011-10037` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.8.0 XSS via Views URL Handling](https://agentprime.io/advisories/CVE-2021-47697.md)
  `CVE-2021-47697` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.4.13 XSS via Views Page](https://agentprime.io/advisories/CVE-2018-25121.md)
  `CVE-2018-25121` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 2012R2.6 XSS via Tools Menu](https://agentprime.io/advisories/CVE-2013-10074.md)
  `CVE-2013-10074` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 2011R1.9 XSS via Status/Report Page Link Functions](https://agentprime.io/advisories/CVE-2011-10040.md)
  `CVE-2011-10040` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.2.4 XSS via Report startdate/enddate Fields](https://agentprime.io/advisories/CVE-2016-15051.md)
  `CVE-2016-15051` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 2011R1.9 XSS via Recurring Downtime Script](https://agentprime.io/advisories/CVE-2011-10038.md)
  `CVE-2011-10038` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.8.0 XSS via My Tools Page](https://agentprime.io/advisories/CVE-2021-47695.md)
  `CVE-2021-47695` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.2.4 XSS via “My Reports” Listing](https://agentprime.io/advisories/CVE-2016-15053.md)
  `CVE-2016-15053` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.2.4 XSS via Menu System](https://agentprime.io/advisories/CVE-2016-15052.md)
  `CVE-2016-15052` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.7.3 XSS via Manage Users in Admin Interface](https://agentprime.io/advisories/CVE-2020-36866.md)
  `CVE-2020-36866` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 2024R1 XSS via Graph Explorer](https://agentprime.io/advisories/CVE-2023-7316.md)
  `CVE-2023-7316` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.11.3 XSS via Graph Explorer](https://agentprime.io/advisories/CVE-2023-7315.md)
  `CVE-2023-7315` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 2024R1.1.3 XSS via Executive Summary Report](https://agentprime.io/advisories/CVE-2024-14001.md)
  `CVE-2024-14001` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.7.2 XSS via Dashboard Background Color Setting](https://agentprime.io/advisories/CVE-2020-36864.md)
  `CVE-2020-36864` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 2024R1.0.2 XSS via Core Command Expansion](https://agentprime.io/advisories/CVE-2023-7318.md)
  `CVE-2023-7318` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 2024R1.1.3 XSS via Capacity Planning Report](https://agentprime.io/advisories/CVE-2024-14000.md)
  `CVE-2024-14000` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.11.3 XSS via Bulk Modifications](https://agentprime.io/advisories/CVE-2023-7313.md)
  `CVE-2023-7313` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.7.2 XSS via BPI Config Management](https://agentprime.io/advisories/CVE-2020-36865.md)
  `CVE-2020-36865` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.8.0 XSS via BPI Config ID Handling](https://agentprime.io/advisories/CVE-2021-47696.md)
  `CVE-2021-47696` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.11.3 XSS via Bandwidth Report](https://agentprime.io/advisories/CVE-2023-7314.md)
  `CVE-2023-7314` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 2011R1.9 XSS via backend_url JavaScript Link Handler](https://agentprime.io/advisories/CVE-2011-10036.md)
  `CVE-2011-10036` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 2011R1.9 XSS via Alert Heatmap Report & “My Reports” Listing](https://agentprime.io/advisories/CVE-2011-10039.md)
  `CVE-2011-10039` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.8.7 XSS in Audit Log via Send to NLS Form](https://agentprime.io/advisories/CVE-2021-47699.md)
  `CVE-2021-47699` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.11.3 XSS & CSRF via Hypermap Replay](https://agentprime.io/advisories/CVE-2023-53688.md)
  `CVE-2023-53688` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF)
- [Nagios XI < 2024R1 Web SSH Terminal Missing Access Control](https://agentprime.io/advisories/CVE-2023-7317.md)
  `CVE-2023-7317` · CVE record: Nagios XI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2025 · Tags: Broken access control
- [Nagios XI < 5.7.2 Unrestricted File Upload via Audio Import Directory](https://agentprime.io/advisories/CVE-2020-36863.md)
  `CVE-2020-36863` · CVE record: Nagios XI · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2025 · Tags: Unrestricted file upload
- [Nagios XI < 5.6.11 Unauthenticated XSS and SSRF via Highcharts](https://agentprime.io/advisories/CVE-2020-36862.md)
  `CVE-2020-36862` · CVE record: Nagios XI · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS), Server-side request forgery (SSRF)
- [Nagios XI < 5.8.9 Stored XSS via Command Names in Apply Config Error Text](https://agentprime.io/advisories/CVE-2022-50587.md)
  `CVE-2022-50587` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.8.9 Stored XSS via BPI Info URL](https://agentprime.io/advisories/CVE-2022-50586.md)
  `CVE-2022-50586` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.8.9 Stored XSS in Update Checking](https://agentprime.io/advisories/CVE-2022-50588.md)
  `CVE-2022-50588` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit Page](https://agentprime.io/advisories/CVE-2020-36869.md)
  `CVE-2020-36869` · CVE record: Nagios XI · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2025 · Tags: SQL injection
- [Nagios XI < 5.2.4 SQL Injection in Notification Search](https://agentprime.io/advisories/CVE-2016-15050.md)
  `CVE-2016-15050` · CVE record: Nagios XI · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2025 · Tags: SQL injection
- [Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change](https://agentprime.io/advisories/CVE-2024-13996.md)
  `CVE-2024-13996` · CVE record: Nagios XI · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2025 · Tags: Authentication bypass
- [Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older Browsers](https://agentprime.io/advisories/CVE-2024-13993.md)
  `CVE-2024-13993` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 2012R1.6 Reflected XSS via Dashlet AJAX Load Functionality](https://agentprime.io/advisories/CVE-2013-10071.md)
  `CVE-2013-10071` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 2024R1.3.2 RCE via WinRM Configuration Wizard](https://agentprime.io/advisories/CVE-2024-14008.md)
  `CVE-2024-14008` · CVE record: Nagios XI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2025 · Tags: Command injection
- [Nagios XI < 2026R1 RCE via Run Check Command in CCM](https://agentprime.io/advisories/CVE-2025-34286.md)
  `CVE-2025-34286` · CVE record: Nagios XI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2025 · Tags: Command injection
- [Nagios XI < 2024R1.2 RCE via NRDP Server Plugins](https://agentprime.io/advisories/CVE-2024-14003.md)
  `CVE-2024-14003` · CVE record: Nagios XI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2025 · Tags: Command injection
- [Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)](https://agentprime.io/advisories/CVE-2025-34134.md)
  `CVE-2025-34134` · CVE record: Nagios XI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2025 · Tags: Command injection
- [Nagios XI < 2011R1.9 Race Conditions in Crontab Install Scripts LPE](https://agentprime.io/advisories/CVE-2011-10035.md)
  `CVE-2011-10035` · CVE record: Nagios XI · CVSS 7.3 High · Not analysed yet · Published 30 Oct 2025 · Tags: Race condition
- [Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile](https://agentprime.io/advisories/CVE-2024-14009.md)
  `CVE-2024-14009` · CVE record: Nagios XI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2025 · Tags: Privilege escalation
- [Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)](https://agentprime.io/advisories/CVE-2024-14004.md)
  `CVE-2024-14004` · CVE record: Nagios XI · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2025 · Tags: Privilege escalation
- [Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component](https://agentprime.io/advisories/CVE-2018-25123.md)
  `CVE-2018-25123` · CVE record: Nagios XI · CVSS 8.5 High · Not analysed yet · Published 30 Oct 2025 · Tags: Privilege escalation
- [Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh Script](https://agentprime.io/advisories/CVE-2020-36868.md)
  `CVE-2020-36868` · CVE record: Nagios XI · CVSS 8.5 High · Not analysed yet · Published 30 Oct 2025 · Tags: Path traversal, Privilege escalation
- [Nagios XI < 2024R2 Privilege Escalation via process_perfdata.pl](https://agentprime.io/advisories/CVE-2025-34287.md)
  `CVE-2025-34287` · CVE record: Nagios XI · CVSS 8.4 High · Not analysed yet · Published 30 Oct 2025 · Tags: Broken access control
- [Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files](https://agentprime.io/advisories/CVE-2025-34135.md)
  `CVE-2025-34135` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Broken access control
- [Nagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary Directory](https://agentprime.io/advisories/CVE-2021-47700.md)
  `CVE-2021-47700` · CVE record: Nagios XI · CVSS 8.5 High · Not analysed yet · Published 30 Oct 2025 · Tags: Privilege escalation
- [Nagios XI < 2024R1.2.2 Host Header Injection](https://agentprime.io/advisories/CVE-2024-14006.md)
  `CVE-2024-14006` · CVE record: Nagios XI · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2025 · Tags: CWE-346
- [Nagios XI < 5.4.13 Component Download Page RCE](https://agentprime.io/advisories/CVE-2018-25122.md)
  `CVE-2018-25122` · CVE record: Nagios XI · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2025 · Tags: Command injection
- [Nagios XI < 2024R1.2 Command Injection via Docker Wizard](https://agentprime.io/advisories/CVE-2024-14005.md)
  `CVE-2024-14005` · CVE record: Nagios XI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2025 · Tags: Command injection
- [Nagios XI < 5.7.3 Command Injection in Report PDF Download](https://agentprime.io/advisories/CVE-2020-36867.md)
  `CVE-2020-36867` · CVE record: Nagios XI · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2025 · Tags: Command injection
- [Nagios XI < 5.8.0 Core Config Manager (CCM) XSS via Templates Pages](https://agentprime.io/advisories/CVE-2021-47689.md)
  `CVE-2021-47689` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.8.2 Core Config Manager (CCM) XSS via Services Page](https://agentprime.io/advisories/CVE-2021-47691.md)
  `CVE-2021-47691` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)

Older: <https://agentprime.io/advisories/technology/nagios-xi.md?cursor=WyIyMDI1LTEwLTMwVDIxOjM2OjI4LjEzMTAwMFoiLCJDVkUtMjAyMS00NzY5MSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=nagios-xi>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/nagios-xi/>. Everything for agents: <https://agentprime.io/llms.txt>.