Skip to content
OpenAdvisories

Package · Debian

nagios4

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-48549

    Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie

    Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allo…

    Nagios Enterprises, LLC. Nagios Core Nagios XI nagios4 Debian Ubuntu
  • Medium 6.5
    CVE-2026-48548

    Nagios Core CSRF via cmd.cgi

    Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Na…

    Nagios Enterprises, LLC. Nagios Core nagios4 nagios4 Debian Ubuntu
  • Medium 5.4
    CVE-2026-48552

    Nagios Core / XI DOM-based XSS via jsonquery.js

    Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbit…

    Nagios Enterprises, LLC. Nagios Core Nagios XI nagios4 Debian Ubuntu
  • Medium 6.1
    CVE-2026-48550

    Nagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter

    Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, execut…

    Nagios Enterprises, LLC. Nagios Core Nagios XI nagios4 Debian Ubuntu