Nagios Nagios Xi any version

Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are able to modify files that are included (aka sourced) by scripts executed by root.

Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.

Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection

A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.

In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.

The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arbitrary sql queries.

A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.

Nagios XI < 2012R1.6 Auto-Discovery Shell Command Injection

Nagios XI < 5.7.3 Command Injection in Report PDF Download

Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE

Nagios XI < 5.4.13 Component Download Page RCE

Nagios XI < 5.7.2 Unrestricted File Upload via Audio Import Directory

Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure

Nagios XI < 5.8.5 Core Config Manager (CCM) SQL Injection via Improper Escaping in Search Text

Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)

Nagios XI < 5.2.4 SQL Injection in Notification Search

Nagios XI < 5.7.4 Core Config Manager (CCM) SQL Injection via Object Edit Pages

Nagios XI < 2024R1.2.2 Host Header Injection

Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit Page

Nagios XI < 5.6.14 Authenticated SQL Injection via SNMP Trap Interface Page

Nagios XI Privilege Escalation via Writable PHP Include Executed with Sudo

Nagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary Directory

Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component

Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh Script

Nagios XI < 2024R2 Privilege Escalation via process_perfdata.pl

Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php.

Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument.

Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database.

Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions.

SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php.

Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php.

Nagios XI < 2011R1.9 Race Conditions in Crontab Install Scripts LPE

Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter.

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter.

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter.

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter.

A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings.

Nagios XI < 2012R1.6 Auto-Discovery Missing Authorization

Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVis