# Nagios XI.

Every CVE that names Nagios XI among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Nagios XI < 5.8.8 Core Config Manager (CCM) XSS via Search & Deletion Flows](https://agentprime.io/advisories/CVE-2022-50584.md)
  `CVE-2022-50584` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.7.5 Core Config Manager (CCM) XSS via Overlay Rendering and Notification/Check Period Pages](https://agentprime.io/advisories/CVE-2020-36861.md)
  `CVE-2020-36861` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.8.2 Core Config Manager (CCM) XSS via Overlay Modals](https://agentprime.io/advisories/CVE-2021-47690.md)
  `CVE-2021-47690` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.7.4 Core Config Manager (CCM) XSS via Object Edit Pages](https://agentprime.io/advisories/CVE-2020-36860.md)
  `CVE-2020-36860` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.8.9 Core Config Manager (CCM) XSS via Audit Log Page Search Input](https://agentprime.io/advisories/CVE-2022-50585.md)
  `CVE-2022-50585` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Nagios XI < 5.7.4 Core Config Manager (CCM) SQL Injection via Object Edit Pages](https://agentprime.io/advisories/CVE-2020-36859.md)
  `CVE-2020-36859` · CVE record: Nagios XI · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2025 · Tags: SQL injection
- [Nagios XI < 5.8.5 Core Config Manager (CCM) SQL Injection via Improper Escaping in Search Text](https://agentprime.io/advisories/CVE-2021-47693.md)
  `CVE-2021-47693` · CVE record: Nagios XI · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2025 · Tags: SQL injection
- [Nagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test Command](https://agentprime.io/advisories/CVE-2021-47694.md)
  `CVE-2021-47694` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS), CWE-116
- [Nagios XI < 2012R1.6 Auto-Discovery Shell Command Injection](https://agentprime.io/advisories/CVE-2013-10073.md)
  `CVE-2013-10073` · CVE record: Nagios XI · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2025 · Tags: Command injection
- [Nagios XI < 2012R1.6 Auto-Discovery Missing Authorization](https://agentprime.io/advisories/CVE-2013-10072.md)
  `CVE-2013-10072` · CVE record: Nagios XI · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2025 · Tags: Broken access control
- [Nagios XI < 5.6.14 Authenticated SQL Injection via SNMP Trap Interface Page](https://agentprime.io/advisories/CVE-2020-36857.md)
  `CVE-2020-36857` · CVE record: Nagios XI · CVSS 8.6 High · Not analysed yet · Published 30 Oct 2025 · Tags: SQL injection
- [Nagios XI < 2012R1.3 Authenticated SQL Injection in Legacy CCM](https://agentprime.io/advisories/CVE-2012-10063.md)
  `CVE-2012-10063` · CVE record: Nagios XI · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2025 · Tags: SQL injection
- [Nagios XI < 5.6.14 Authenticated RCE command_test.php via address](https://agentprime.io/advisories/CVE-2020-36856.md)
  `CVE-2020-36856` · CVE record: Nagios XI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2025 · Tags: Command injection
- [Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVis](https://agentprime.io/advisories/CVE-2024-14002.md)
  `CVE-2024-14002` · CVE record: Nagios XI · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2025 · Tags: File inclusion
- [Nagios XI < 2024R2 Authenticated Command Injection via WinRM Plugin](https://agentprime.io/advisories/CVE-2025-34284.md)
  `CVE-2025-34284` · CVE record: Nagios XI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2025 · Tags: Command injection
- [Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure](https://agentprime.io/advisories/CVE-2024-13995.md)
  `CVE-2024-13995` · CVE record: Nagios XI · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2025 · Tags: Information disclosure
- [Nagios XI < 2024R1.4.2 API Key Disclosure via Neptune Themes](https://agentprime.io/advisories/CVE-2025-34283.md)
  `CVE-2025-34283` · CVE record: Nagios XI · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2025 · Tags: Information disclosure
- [Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization](https://agentprime.io/advisories/CVE-2024-13994.md)
  `CVE-2024-13994` · CVE record: Nagios XI · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2025 · Tags: Broken access control
- [Nagios XI < 2024R1.1.3 AD/LDAP Token Authenticated Information Disclosure](https://agentprime.io/advisories/CVE-2024-13999.md)
  `CVE-2024-13999` · CVE record: Nagios XI · CVSS 7.3 High · Not analysed yet · Published 30 Oct 2025 · Tags: Information disclosure
- [Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection](https://agentprime.io/advisories/CVE-2025-34227.md)
  `CVE-2025-34227` · CVE record: Nagios Nagios XI · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.26 · Not analysed yet · Published 25 Sept 2025 · Tags: Command injection
- [Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE](https://agentprime.io/advisories/CVE-2024-13986.md)
  `CVE-2024-13986` · CVE record: Nagios Nagios XI · CVSS 8.7 High · Not analysed yet · Published 28 Aug 2025 · Tags: Path traversal, Unrestricted file upload
- [Cross-site scripting in Nagios XI](https://agentprime.io/advisories/CVE-2021-33179.md)
  `CVE-2021-33179` · CVE record: Nagios Nagios XI · No CVSS score · EPSS 0.12 · Not analysed yet · Published 14 Oct 2021 · Tags: Cross-site scripting (XSS)
- [SQL injection in Nagios XI](https://agentprime.io/advisories/CVE-2021-33177.md)
  `CVE-2021-33177` · CVE record: Nagios Nagios XI · No CVSS score · EPSS 0.10 · Not analysed yet · Published 14 Oct 2021 · Tags: SQL injection
- [Nagios XI: Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged…](https://agentprime.io/advisories/CVE-2020-5796.md)
  `CVE-2020-5796` · CVE record: Nagios XI · No CVSS score · Not analysed yet · Published 13 Nov 2020
- [Nagios XI: Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3…](https://agentprime.io/advisories/CVE-2020-5791.md)
  `CVE-2020-5791` · CVE record: Nagios XI · No CVSS score · EPSS 0.79 · Not analysed yet · Published 20 Oct 2020
- [Nagios XI: Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform…](https://agentprime.io/advisories/CVE-2020-5790.md)
  `CVE-2020-5790` · CVE record: Nagios XI · No CVSS score · Not analysed yet · Published 20 Oct 2020
- [Nagios XI: Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a…](https://agentprime.io/advisories/CVE-2020-5792.md)
  `CVE-2020-5792` · CVE record: Nagios XI · No CVSS score · EPSS 0.59 · Not analysed yet · Published 20 Oct 2020
- [Nagios XI: Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated…](https://agentprime.io/advisories/CVE-2018-15714.md)
  `CVE-2018-15714` · CVE record: Nagios Nagios XI · No CVSS score · Not analysed yet · Published 14 Nov 2018
- [Nagios XI: Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated…](https://agentprime.io/advisories/CVE-2018-15713.md)
  `CVE-2018-15713` · CVE record: Nagios Nagios XI · No CVSS score · Not analysed yet · Published 14 Nov 2018
- [Nagios XI: Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated…](https://agentprime.io/advisories/CVE-2018-15712.md)
  `CVE-2018-15712` · CVE record: Nagios Nagios XI · No CVSS score · EPSS 0.49 · Not analysed yet · Published 14 Nov 2018
- [Nagios XI: Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key…](https://agentprime.io/advisories/CVE-2018-15711.md)
  `CVE-2018-15711` · CVE record: Nagios Nagios XI · No CVSS score · EPSS 0.36 · Not analysed yet · Published 14 Nov 2018
- [Nagios XI: Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via…](https://agentprime.io/advisories/CVE-2018-15710.md)
  `CVE-2018-15710` · CVE record: Nagios Nagios XI · No CVSS score · EPSS 0.38 · Not analysed yet · Published 14 Nov 2018
- [Nagios XI: Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a…](https://agentprime.io/advisories/CVE-2018-15709.md)
  `CVE-2018-15709` · CVE record: Nagios Nagios XI · No CVSS score · EPSS 0.21 · Not analysed yet · Published 14 Nov 2018
- [Nagios XI: Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute…](https://agentprime.io/advisories/CVE-2018-15708.md)
  `CVE-2018-15708` · CVE record: Nagios Nagios XI · No CVSS score · EPSS 0.89 · Not analysed yet · Published 14 Nov 2018

Newest: <https://agentprime.io/advisories/technology/nagios-xi.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=nagios-xi&cursor=WyIyMDI1LTEwLTMwVDIxOjM2OjI4LjEzMTAwMFoiLCJDVkUtMjAyMS00NzY5MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/nagios-xi/?cursor=WyIyMDI1LTEwLTMwVDIxOjM2OjI4LjEzMTAwMFoiLCJDVkUtMjAyMS00NzY5MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.