Nagios Nagios Xi

Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection.

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root.

An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can upload ZIP files. A command injection (within the name of the first file in the archive) allows an attacker to execute system commands.

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.

Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system.

Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.

Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are able to modify files that are included (aka sourced) by scripts executed by root.

Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability

Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability

Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.

Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges.

Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection

A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.

In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.

Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request.

Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query.

The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arbitrary sql queries.

Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability

A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.

Nagios XI < 2012R1.6 Auto-Discovery Shell Command Injection

Nagios XI < 5.7.3 Command Injection in Report PDF Download

Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE

Nagios XI < 5.4.13 Component Download Page RCE

An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet.

Nagios XI < 5.7.2 Unrestricted File Upload via Audio Import Directory

Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure

In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.

Nagios XI < 5.8.5 Core Config Manager (CCM) SQL Injection via Improper Escaping in Search Text

Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)

Nagios XI < 5.2.4 SQL Injection in Notification Search

Nagios XI < 5.7.4 Core Config Manager (CCM) SQL Injection via Object Edit Pages

Nagios XI < 2024R1.2.2 Host Header Injection

Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit Page

Nagios XI < 5.6.14 Authenticated SQL Injection via SNMP Trap Interface Page

Nagios XI Privilege Escalation via Writable PHP Include Executed with Sudo

Nagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary Directory

Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component

Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh Script

Nagios XI < 2024R2 Privilege Escalation via process_perfdata.pl