13 results · Feed
-
Medium 6.5
Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allo…
-
Medium 6.5
Nagios Core CSRF via cmd.cgi
Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Na…
-
High 7.5
Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or…
-
High 7.5
Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor (NRDP). When a custom variable defined on a host, service, or contact is…
-
Medium 5.4
Nagios Core / XI DOM-based XSS via jsonquery.js
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbit…
-
High 7.4
Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling un…
-
Medium 6.1
Nagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, execut…
-
Unscored —
Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, l…
-
Unscored —
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration …
-
Unscored —
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivere…
-
Unscored —CVE-2018-13441 Public exploit
qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows att…
-
Unscored —CVE-2018-13458 Public exploit
qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers t…
-
Unscored —CVE-2018-13457 Public exploit
qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers t…