Advisories · Technology

Nagios XI.

Every CVE that names Nagios XI among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2022-50584 CVE record

CVSS 5.1 Medium

Nagios XI < 5.8.8 Core Config Manager (CCM) XSS via Search & Deletion Flows
- Nagios XI
- Cross-site scripting (XSS)
Not analysed yet 30 Oct 2025
CVE-2020-36861 CVE record

CVSS 5.1 Medium

Nagios XI < 5.7.5 Core Config Manager (CCM) XSS via Overlay Rendering and Notification/Check Period Pages
- Nagios XI
- Cross-site scripting (XSS)
Not analysed yet 30 Oct 2025
CVE-2021-47690 CVE record

CVSS 5.1 Medium

Nagios XI < 5.8.2 Core Config Manager (CCM) XSS via Overlay Modals
- Nagios XI
- Cross-site scripting (XSS)
Not analysed yet 30 Oct 2025
CVE-2020-36860 CVE record

CVSS 5.1 Medium

Nagios XI < 5.7.4 Core Config Manager (CCM) XSS via Object Edit Pages
- Nagios XI
- Cross-site scripting (XSS)
Not analysed yet 30 Oct 2025
CVE-2022-50585 CVE record

CVSS 5.1 Medium

Nagios XI < 5.8.9 Core Config Manager (CCM) XSS via Audit Log Page Search Input
- Nagios XI
- Cross-site scripting (XSS)
Not analysed yet 30 Oct 2025
CVE-2020-36859 CVE record

CVSS 8.7 High

Nagios XI < 5.7.4 Core Config Manager (CCM) SQL Injection via Object Edit Pages
- Nagios XI
- SQL injection
Not analysed yet 30 Oct 2025
CVE-2021-47693 CVE record

CVSS 8.7 High

Nagios XI < 5.8.5 Core Config Manager (CCM) SQL Injection via Improper Escaping in Search Text
- Nagios XI
- SQL injection
Not analysed yet 30 Oct 2025
CVE-2021-47694 CVE record

CVSS 5.1 Medium

Nagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test Command
- Nagios XI
- Cross-site scripting (XSS)
- CWE-116
Not analysed yet 30 Oct 2025
CVE-2013-10073 CVE record

CVSS 8.7 High

Nagios XI < 2012R1.6 Auto-Discovery Shell Command Injection
- Nagios XI
- Command injection
Not analysed yet 30 Oct 2025
CVE-2013-10072 CVE record

CVSS 7.2 High

Nagios XI < 2012R1.6 Auto-Discovery Missing Authorization
- Nagios XI
- Broken access control
Not analysed yet 30 Oct 2025
CVE-2020-36857 CVE record

CVSS 8.6 High

Nagios XI < 5.6.14 Authenticated SQL Injection via SNMP Trap Interface Page
- Nagios XI
- SQL injection
Not analysed yet 30 Oct 2025
CVE-2012-10063 CVE record

CVSS 8.7 High

Nagios XI < 2012R1.3 Authenticated SQL Injection in Legacy CCM
- Nagios XI
- SQL injection
Not analysed yet 30 Oct 2025
CVE-2020-36856 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Nagios XI < 5.6.14 Authenticated RCE command_test.php via address
- Nagios XI
- Command injection
Not analysed yet 30 Oct 2025
CVE-2024-14002 CVE record

CVSS 7.1 High

Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVis
- Nagios XI
- File inclusion
Not analysed yet 30 Oct 2025
CVE-2025-34284 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Nagios XI < 2024R2 Authenticated Command Injection via WinRM Plugin
- Nagios XI
- Command injection
Not analysed yet 30 Oct 2025
CVE-2024-13995 CVE record

CVSS 7.1 High

Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure
- Nagios XI
- Information disclosure
Not analysed yet 30 Oct 2025
CVE-2025-34283 CVE record

CVSS 7.1 High

Nagios XI < 2024R1.4.2 API Key Disclosure via Neptune Themes
- Nagios XI
- Information disclosure
Not analysed yet 30 Oct 2025
CVE-2024-13994 CVE record

CVSS 8.7 High

Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization
- Nagios XI
- Broken access control
Not analysed yet 30 Oct 2025
CVE-2024-13999 CVE record

CVSS 7.3 High

Nagios XI < 2024R1.1.3 AD/LDAP Token Authenticated Information Disclosure
- Nagios XI
- Information disclosure
Not analysed yet 30 Oct 2025
CVE-2025-34227 CVE record

CVSS 8.6 HighCritical · CVSS 7+ and EPSS

Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection
- Nagios XI
- Command injection
Not analysed yet 25 Sept 2025
CVE-2024-13986 CVE record

CVSS 8.7 High

Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE
- Nagios XI
- Path traversal
- Unrestricted file upload
Not analysed yet 28 Aug 2025
CVE-2021-33179 CVE record

Cross-site scripting in Nagios XI
- Nagios XI
- Cross-site scripting (XSS)
Not analysed yet 14 Oct 2021
CVE-2021-33177 CVE record

SQL injection in Nagios XI
- Nagios XI
- SQL injection
Not analysed yet 14 Oct 2021
CVE-2020-5796 CVE record

Nagios XI: Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged…
- Nagios XI
Not analysed yet 13 Nov 2020
CVE-2020-5791 CVE record

Nagios XI: Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3…
- Nagios XI
Not analysed yet 20 Oct 2020
CVE-2020-5790 CVE record

Nagios XI: Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform…
- Nagios XI
Not analysed yet 20 Oct 2020
CVE-2020-5792 CVE record

Nagios XI: Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a…
- Nagios XI
Not analysed yet 20 Oct 2020
CVE-2018-15714 CVE record

Nagios XI: Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated…
- Nagios XI
Not analysed yet 14 Nov 2018
CVE-2018-15713 CVE record

Nagios XI: Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated…
- Nagios XI
Not analysed yet 14 Nov 2018
CVE-2018-15712 CVE record

Nagios XI: Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated…
- Nagios XI
Not analysed yet 14 Nov 2018
CVE-2018-15711 CVE record

Nagios XI: Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key…
- Nagios XI
Not analysed yet 14 Nov 2018
CVE-2018-15710 CVE record

Nagios XI: Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via…
- Nagios XI
Not analysed yet 14 Nov 2018
CVE-2018-15709 CVE record

Nagios XI: Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a…
- Nagios XI
Not analysed yet 14 Nov 2018
CVE-2018-15708 CVE record

Nagios XI: Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute…
- Nagios XI
Not analysed yet 14 Nov 2018