# cve.now: Nagios

The newest entries naming Nagios as an affected vendor (up to 200), of 119 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2023-24035](https://cve.now/CVE-2023-24035.md): An issue was discovered in Nagios XI before 5.9.3. (CVSS 3.5)
- [CVE-2023-24034](https://cve.now/CVE-2023-24034.md): An issue was discovered in twilio\_ajax\_handler.php in Nagios XI before 5.9.3. (CVSS 3.1)
- [CVE-2026-2041](https://cve.now/CVE-2026-2041.md): Nagios Host zabbixagent\_configwizard\_func Command Injection Remote Code Execution Vulnerability (CVSS 7.2)
- [CVE-2026-2043](https://cve.now/CVE-2026-2043.md): Nagios Host esensors\_websensor\_configwizard\_func Command Injection Remote Code Execution Vulnerability (CVSS 7.2)
- [CVE-2026-2042](https://cve.now/CVE-2026-2042.md): Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability (CVSS 7.2)
- [CVE-2025-34323](https://cve.now/CVE-2025-34323.md): Nagios Log Server \< 2026R1.0.1 Local Privilege Escalation via Writable Scripts and Sudo Rules (CVSS 8.5)
- [CVE-2025-34322](https://cve.now/CVE-2025-34322.md): Nagios Log Server \< 2026R1.0.1 Authenticated Command Injection via Natural Language Queries (CVSS 8.6)
- [CVE-2021-47698](https://cve.now/CVE-2021-47698.md): Nagios XI \< 5.8.7 XSS in Core UI Views URL handling (CVSS 5.1)
- [CVE-2024-13997](https://cve.now/CVE-2024-13997.md): Nagios XI \< 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host (CVSS 9.4)
- [CVE-2024-13998](https://cve.now/CVE-2024-13998.md): Nagios XI \< 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure (CVSS 6.0)
- [CVE-2024-13992](https://cve.now/CVE-2024-13992.md): Nagios XI \< 2024R1.1 XSS via Missing Page / 404 (CVSS 5.1)
- [CVE-2011-10037](https://cve.now/CVE-2011-10037.md): Nagios XI \< 2011R1.9 XSS via xiwindow Variables Affecting Permalinks (CVSS 5.1)
- [CVE-2021-47697](https://cve.now/CVE-2021-47697.md): Nagios XI \< 5.8.0 XSS via Views URL Handling (CVSS 5.1)
- [CVE-2018-25121](https://cve.now/CVE-2018-25121.md): Nagios XI \< 5.4.13 XSS via Views Page (CVSS 5.1)
- [CVE-2013-10074](https://cve.now/CVE-2013-10074.md): Nagios XI \< 2012R2.6 XSS via Tools Menu (CVSS 5.1)
- [CVE-2011-10040](https://cve.now/CVE-2011-10040.md): Nagios XI \< 2011R1.9 XSS via Status/Report Page Link Functions (CVSS 5.1)
- [CVE-2016-15051](https://cve.now/CVE-2016-15051.md): Nagios XI \< 5.2.4 XSS via Report startdate/enddate Fields (CVSS 5.1)
- [CVE-2011-10038](https://cve.now/CVE-2011-10038.md): Nagios XI \< 2011R1.9 XSS via Recurring Downtime Script (CVSS 5.1)
- [CVE-2021-47695](https://cve.now/CVE-2021-47695.md): Nagios XI \< 5.8.0 XSS via My Tools Page (CVSS 5.1)
- [CVE-2016-15053](https://cve.now/CVE-2016-15053.md): Nagios XI \< 5.2.4 XSS via “My Reports” Listing (CVSS 5.1)
- [CVE-2016-15052](https://cve.now/CVE-2016-15052.md): Nagios XI \< 5.2.4 XSS via Menu System (CVSS 5.1)
- [CVE-2020-36866](https://cve.now/CVE-2020-36866.md): Nagios XI \< 5.7.3 XSS via Manage Users in Admin Interface (CVSS 5.1)
- [CVE-2023-7316](https://cve.now/CVE-2023-7316.md): Nagios XI \< 2024R1 XSS via Graph Explorer (CVSS 5.1)
- [CVE-2023-7315](https://cve.now/CVE-2023-7315.md): Nagios XI \< 5.11.3 XSS via Graph Explorer (CVSS 5.1)
- [CVE-2024-14001](https://cve.now/CVE-2024-14001.md): Nagios XI \< 2024R1.1.3 XSS via Executive Summary Report (CVSS 5.1)
- [CVE-2020-36864](https://cve.now/CVE-2020-36864.md): Nagios XI \< 5.7.2 XSS via Dashboard Background Color Setting (CVSS 5.1)
- [CVE-2023-7318](https://cve.now/CVE-2023-7318.md): Nagios XI \< 2024R1.0.2 XSS via Core Command Expansion (CVSS 5.1)
- [CVE-2024-14000](https://cve.now/CVE-2024-14000.md): Nagios XI \< 2024R1.1.3 XSS via Capacity Planning Report (CVSS 5.1)
- [CVE-2023-7313](https://cve.now/CVE-2023-7313.md): Nagios XI \< 5.11.3 XSS via Bulk Modifications (CVSS 5.1)
- [CVE-2020-36865](https://cve.now/CVE-2020-36865.md): Nagios XI \< 5.7.2 XSS via BPI Config Management (CVSS 5.1)
- [CVE-2021-47696](https://cve.now/CVE-2021-47696.md): Nagios XI \< 5.8.0 XSS via BPI Config ID Handling (CVSS 5.1)
- [CVE-2023-7314](https://cve.now/CVE-2023-7314.md): Nagios XI \< 5.11.3 XSS via Bandwidth Report (CVSS 5.1)
- [CVE-2011-10036](https://cve.now/CVE-2011-10036.md): Nagios XI \< 2011R1.9 XSS via backend\_url JavaScript Link Handler (CVSS 5.1)
- [CVE-2011-10039](https://cve.now/CVE-2011-10039.md): Nagios XI \< 2011R1.9 XSS via Alert Heatmap Report & “My Reports” Listing (CVSS 5.1)
- [CVE-2021-47699](https://cve.now/CVE-2021-47699.md): Nagios XI \< 5.8.7 XSS in Audit Log via Send to NLS Form (CVSS 5.1)
- [CVE-2023-53688](https://cve.now/CVE-2023-53688.md): Nagios XI \< 5.11.3 XSS & CSRF via Hypermap Replay (CVSS 5.1)
- [CVE-2023-7317](https://cve.now/CVE-2023-7317.md): Nagios XI \< 2024R1 Web SSH Terminal Missing Access Control (CVSS 9.4)
- [CVE-2020-36863](https://cve.now/CVE-2020-36863.md): Nagios XI \< 5.7.2 Unrestricted File Upload via Audio Import Directory (CVSS 8.7)
- [CVE-2020-36862](https://cve.now/CVE-2020-36862.md): Nagios XI \< 5.6.11 Unauthenticated XSS and SSRF via Highcharts (CVSS 6.9)
- [CVE-2022-50587](https://cve.now/CVE-2022-50587.md): Nagios XI \< 5.8.9 Stored XSS via Command Names in Apply Config Error Text (CVSS 5.1)
- [CVE-2022-50586](https://cve.now/CVE-2022-50586.md): Nagios XI \< 5.8.9 Stored XSS via BPI Info URL (CVSS 5.1)
- [CVE-2022-50588](https://cve.now/CVE-2022-50588.md): Nagios XI \< 5.8.9 Stored XSS in Update Checking (CVSS 5.1)
- [CVE-2020-36869](https://cve.now/CVE-2020-36869.md): Nagios XI \< 5.7.5 SQL injection via SNMP Trap Interface Edit Page (CVSS 8.7)
- [CVE-2016-15050](https://cve.now/CVE-2016-15050.md): Nagios XI \< 5.2.4 SQL Injection in Notification Search (CVSS 8.7)
- [CVE-2024-13996](https://cve.now/CVE-2024-13996.md): Nagios XI \< 2024R1.1.3 Session Not Invalidated After Password Change (CVSS 9.2)
- [CVE-2024-13993](https://cve.now/CVE-2024-13993.md): Nagios XI \< 2024R1.1.2 Reflected XSS via Login Page on Older Browsers (CVSS 5.1)
- [CVE-2013-10071](https://cve.now/CVE-2013-10071.md): Nagios XI \< 2012R1.6 Reflected XSS via Dashlet AJAX Load Functionality (CVSS 5.1)
- [CVE-2024-14008](https://cve.now/CVE-2024-14008.md): Nagios XI \< 2024R1.3.2 RCE via WinRM Configuration Wizard (CVSS 9.4)
- [CVE-2025-34286](https://cve.now/CVE-2025-34286.md): Nagios XI \< 2026R1 RCE via Run Check Command in CCM (CVSS 9.4)
- [CVE-2024-14003](https://cve.now/CVE-2024-14003.md): Nagios XI \< 2024R1.2 RCE via NRDP Server Plugins (CVSS 9.4)
- [CVE-2025-34134](https://cve.now/CVE-2025-34134.md): Nagios XI \< 2024R1.4.2 RCE via Business Process Intelligence (BPI) (CVSS 9.4)
- [CVE-2011-10035](https://cve.now/CVE-2011-10035.md): Nagios XI \< 2011R1.9 Race Conditions in Crontab Install Scripts LPE (CVSS 7.3)
- [CVE-2024-14009](https://cve.now/CVE-2024-14009.md): Nagios XI \< 2024R1.0.1 Privilege Escalation via System Profile (CVSS 9.4)
- [CVE-2024-14004](https://cve.now/CVE-2024-14004.md): Nagios XI \< 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf) (CVSS 8.7)
- [CVE-2018-25123](https://cve.now/CVE-2018-25123.md): Nagios XI \< 5.5.7 Privilege Escalation via MRTG Graphing Component (CVSS 8.5)
- [CVE-2020-36868](https://cve.now/CVE-2020-36868.md): Nagios XI \< 5.7.3 Privilege escalation via Insecure getprofile.sh Script (CVSS 8.5)
- [CVE-2025-34287](https://cve.now/CVE-2025-34287.md): Nagios XI \< 2024R2 Privilege Escalation via process\_perfdata.pl (CVSS 8.4)
- [CVE-2025-34135](https://cve.now/CVE-2025-34135.md): Nagios XI \< 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files (CVSS 5.1)
- [CVE-2021-47700](https://cve.now/CVE-2021-47700.md): Nagios XI \< 5.8.7 Insecure Permissions on Highcharts Temporary Directory (CVSS 8.5)
- [CVE-2024-14006](https://cve.now/CVE-2024-14006.md): Nagios XI \< 2024R1.2.2 Host Header Injection (CVSS 8.8)
- [CVE-2018-25122](https://cve.now/CVE-2018-25122.md): Nagios XI \< 5.4.13 Component Download Page RCE (CVSS 8.7)
- [CVE-2024-14005](https://cve.now/CVE-2024-14005.md): Nagios XI \< 2024R1.2 Command Injection via Docker Wizard (CVSS 9.4)
- [CVE-2020-36867](https://cve.now/CVE-2020-36867.md): Nagios XI \< 5.7.3 Command Injection in Report PDF Download (CVSS 8.7)
- [CVE-2021-47689](https://cve.now/CVE-2021-47689.md): Nagios XI \< 5.8.0 Core Config Manager (CCM) XSS via Templates Pages (CVSS 5.1)
- [CVE-2021-47691](https://cve.now/CVE-2021-47691.md): Nagios XI \< 5.8.2 Core Config Manager (CCM) XSS via Services Page (CVSS 5.1)
- [CVE-2022-50584](https://cve.now/CVE-2022-50584.md): Nagios XI \< 5.8.8 Core Config Manager (CCM) XSS via Search & Deletion Flows (CVSS 5.1)
- [CVE-2020-36861](https://cve.now/CVE-2020-36861.md): Nagios XI \< 5.7.5 Core Config Manager (CCM) XSS via Overlay Rendering and Notification/Check Period Pages (CVSS 5.1)
- [CVE-2021-47690](https://cve.now/CVE-2021-47690.md): Nagios XI \< 5.8.2 Core Config Manager (CCM) XSS via Overlay Modals (CVSS 5.1)
- [CVE-2020-36860](https://cve.now/CVE-2020-36860.md): Nagios XI \< 5.7.4 Core Config Manager (CCM) XSS via Object Edit Pages (CVSS 5.1)
- [CVE-2022-50585](https://cve.now/CVE-2022-50585.md): Nagios XI \< 5.8.9 Core Config Manager (CCM) XSS via Audit Log Page Search Input (CVSS 5.1)
- [CVE-2020-36859](https://cve.now/CVE-2020-36859.md): Nagios XI \< 5.7.4 Core Config Manager (CCM) SQL Injection via Object Edit Pages (CVSS 8.7)
- [CVE-2021-47693](https://cve.now/CVE-2021-47693.md): Nagios XI \< 5.8.5 Core Config Manager (CCM) SQL Injection via Improper Escaping in Search Text (CVSS 8.7)
- [CVE-2021-47694](https://cve.now/CVE-2021-47694.md): Nagios XI \< 5.8.6 Core Config Manager (CCM) Reflected XSS via Test Command (CVSS 5.1)
- [CVE-2013-10073](https://cve.now/CVE-2013-10073.md): Nagios XI \< 2012R1.6 Auto-Discovery Shell Command Injection (CVSS 8.7)
- [CVE-2013-10072](https://cve.now/CVE-2013-10072.md): Nagios XI \< 2012R1.6 Auto-Discovery Missing Authorization (CVSS 7.2)
- [CVE-2020-36857](https://cve.now/CVE-2020-36857.md): Nagios XI \< 5.6.14 Authenticated SQL Injection via SNMP Trap Interface Page (CVSS 8.6)
- [CVE-2012-10063](https://cve.now/CVE-2012-10063.md): Nagios XI \< 2012R1.3 Authenticated SQL Injection in Legacy CCM (CVSS 8.7)
- [CVE-2020-36856](https://cve.now/CVE-2020-36856.md): Nagios XI \< 5.6.14 Authenticated RCE command\_test.php via address (CVSS 9.4)
- [CVE-2024-14002](https://cve.now/CVE-2024-14002.md): Nagios XI \< 2024R1.1.4 Authenticated Local File Inclusion via NagVis (CVSS 7.1)
- [CVE-2025-34284](https://cve.now/CVE-2025-34284.md): Nagios XI \< 2024R2 Authenticated Command Injection via WinRM Plugin (CVSS 9.4)
- [CVE-2024-13995](https://cve.now/CVE-2024-13995.md): Nagios XI \< 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure (CVSS 7.1)
- [CVE-2025-34283](https://cve.now/CVE-2025-34283.md): Nagios XI \< 2024R1.4.2 API Key Disclosure via Neptune Themes (CVSS 7.1)
- [CVE-2024-13994](https://cve.now/CVE-2024-13994.md): Nagios XI \< 2024R1.1.2 Allow Insecure Logins Missing Authorization (CVSS 8.7)
- [CVE-2024-13999](https://cve.now/CVE-2024-13999.md): Nagios XI \< 2024R1.1.3 AD/LDAP Token Authenticated Information Disclosure (CVSS 7.3)
- [CVE-2023-7319](https://cve.now/CVE-2023-7319.md): Nagios Network Analyzer \< 2024R1 XSS via Percentile Calculator Menu (CVSS 5.1)
- [CVE-2025-34278](https://cve.now/CVE-2025-34278.md): Nagios Network Analyzer \< 2024R1 Source Groups / Percentile Calculator Menu Stored XSS (CVSS 5.1)
- [CVE-2025-34280](https://cve.now/CVE-2025-34280.md): Nagios Network Analyzer \< 2024R2.0.1 RCE in LDAP Certificate Removal Function (CVSS 8.6)
- [CVE-2023-7321](https://cve.now/CVE-2023-7321.md): Nagios Log Server \< 2.1.14 XSS via Snapshots Page (CVSS 5.1)
- [CVE-2023-7323](https://cve.now/CVE-2023-7323.md): Nagios Log Server \< 2024R1 XSS via Create User Function (CVSS 5.1)
- [CVE-2020-36858](https://cve.now/CVE-2020-36858.md): Nagios Log Server \< 2.1.6 XSS via Create User, Edit User, & Manage Host Lists Pages (CVSS 5.1)
- [CVE-2025-34298](https://cve.now/CVE-2025-34298.md): Nagios Log Server \< 2024R1.3.2 Set Email Privilege Escalation (CVSS 8.7)
- [CVE-2025-34277](https://cve.now/CVE-2025-34277.md): Nagios Log Server \< 2024R1.3.1 RCE via Malformed Dashboard ID (CVSS 9.4)
- [CVE-2025-34272](https://cve.now/CVE-2025-34272.md): Nagios Log Server \< 2024R2.0.3 Non-Empty Default Dashboard Fallback (CVSS 5.3)
- [CVE-2025-34273](https://cve.now/CVE-2025-34273.md): Nagios Log Server \< 2024R2.0.3 Non-Admin Dashboard Deletion (CVSS 7.1)
- [CVE-2024-58273](https://cve.now/CVE-2024-58273.md): Nagios Log Server \< 2024R1.0.2 LPE from Apache/Backend Shell User to Root (CVSS 8.5)
- [CVE-2025-34274](https://cve.now/CVE-2025-34274.md): Nagios Log Server \< 2024R2.0.3 Logstash Process Root Privileges (CVSS 9.3)
- [CVE-2023-7322](https://cve.now/CVE-2023-7322.md): Nagios Log Server \< 2024R1 Incorrect Authorization Granting Full API Access (CVSS 8.7)
- [CVE-2016-15049](https://cve.now/CVE-2016-15049.md): Nagios Log Server \< 1.4.2 Dashboards Logs Table XSS (CVSS 5.1)
- [CVE-2025-34271](https://cve.now/CVE-2025-34271.md): Nagios Log Server \< 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext (CVSS 8.7)
- [CVE-2025-34270](https://cve.now/CVE-2025-34270.md): Nagios Log Server \< 2024R2.0.2 AD/LDAP Import Password Not Obfuscated (CVSS 6.9)
- [CVE-2017-20209](https://cve.now/CVE-2017-20209.md): Nagios Fusion \< 4.0.1 XSS via Users/Servers Page (CVSS 5.1)
- [CVE-2018-25119](https://cve.now/CVE-2018-25119.md): Nagios Fusion \< 4.1.5 XSS via fusionwindow Parameter (CVSS 5.1)
- [CVE-2023-53689](https://cve.now/CVE-2023-53689.md): Nagios Fusion \< 4.2.0 License Information Reflected XSS (CVSS 6.0)
- [CVE-2023-53690](https://cve.now/CVE-2023-53690.md): Nagios Fusion \< 4.2.0 LDAP/AD Integration Stored XSS (CVSS 6.2)
- [CVE-2023-7312](https://cve.now/CVE-2023-7312.md): Nagios Fusion \< 4.2.0 Email Settings Stored XSS via SMTP/sendmail (CVSS 6.2)
- [CVE-2025-44824](https://cve.now/CVE-2025-44824.md): Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslo (CVSS 8.5)
- [CVE-2025-44823](https://cve.now/CVE-2025-44823.md): Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.ph (CVSS 9.9)
- [CVE-2025-34227](https://cve.now/CVE-2025-34227.md): Nagios XI \< 2026R1 Configuration Wizard Authenticated Command Injection (CVSS 8.6)
- [CVE-2024-13986](https://cve.now/CVE-2024-13986.md): Nagios XI \< 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE (CVSS 8.7)
- [CVE-2021-4285](https://cve.now/CVE-2021-4285.md): Nagios NCPA tail.html cross site scripting (CVSS 3.5)
- [CVE-2021-33179](https://cve.now/CVE-2021-33179.md): The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. (no CVSS)
- [CVE-2021-33177](https://cve.now/CVE-2021-33177.md): The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. (no CVSS)
- [CVE-2018-15714](https://cve.now/CVE-2018-15714.md): Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters. (no CVSS)
- [CVE-2018-15713](https://cve.now/CVE-2018-15713.md): Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php. (no CVSS)
- [CVE-2018-15712](https://cve.now/CVE-2018-15712.md): Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api\_tool.php. (no CVSS)
- [CVE-2018-15711](https://cve.now/CVE-2018-15711.md): Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. (no CVSS)
- [CVE-2018-15710](https://cve.now/CVE-2018-15710.md): Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover\_new.php. (no CVSS)
- [CVE-2018-15709](https://cve.now/CVE-2018-15709.md): Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request. (no CVSS)
- [CVE-2018-15708](https://cve.now/CVE-2018-15708.md): Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nagios
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.