CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,468 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,468
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product nagios:nagios_xi. Show all products

88 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2019-15949
Known exploited
High 8.8Nagios XI before 5.6.6 allows remote command execution as root.
Assigned by mitre
Sep 5, 2019
CVE-2021-25298
Known exploited
High 8.8Nagios XI version xi-5.7.5 is affected by OS command injection.
Assigned by mitre
Feb 15, 2021
CVE-2021-25297
Known exploited
High 8.8Nagios XI version xi-5.7.5 is affected by OS command injection.
Assigned by mitre
Feb 15, 2021
CVE-2021-25296
Known exploited
High 8.8Nagios XI version xi-5.7.5 is affected by OS command injection.
Assigned by mitre
Feb 15, 2021
CVE-2025-34227High 8.8Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards.Sep 25, 2025
CVE-2011-10035High 7.0Nagios XI versions prior to 2011R1.9 contain privilege escalation vulnerabilities in the scripts that install or update system crontab entries.Oct 30, 2025
CVE-2011-10036Medium 5.4Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of the "backend_url" JavaScript link.Oct 30, 2025
CVE-2011-10037Medium 5.4Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of xiwindow variables used to build permalinks in the web interface.Oct 30, 2025
CVE-2011-10038Medium 5.4Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the recurring downtime script of the web interface.Oct 30, 2025
CVE-2011-10039Medium 5.4Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the Alert Heatmap report and the “My Reports” listing of the web interface.Oct 30, 2025
CVE-2011-10040Medium 5.4Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the link-handling functions used by status and report pages.Oct 30, 2025
CVE-2012-10063Critical 9.8Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface.Oct 30, 2025
CVE-2013-10071Medium 6.1Nagios XI versions prior to 2012R1.6 contain a reflected cross-site scripting (XSS) vulnerability in the dashboard dashlet AJAX load functionality.Oct 30, 2025
CVE-2013-10072Medium 6.5Nagios XI versions prior to 2012R1.6 contain an authorization flaw in the Auto-Discovery functionality.Oct 30, 2025
CVE-2013-10073High 8.8Nagios XI versions prior to 2012R1.6 contain a shell command injection vulnerability in the Auto-Discovery tool.Oct 30, 2025
CVE-2013-10074Medium 5.4Nagios XI versions prior to 2012R2.6 are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface.Oct 30, 2025
CVE-2016-15050High 8.8Nagios XI versions prior to 5.2.4 contain a SQL injection vulnerability in the notification search functionality.Oct 30, 2025
CVE-2016-15051Medium 5.4Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Reports interface through values from the startdate and enddate fields.Oct 30, 2025
CVE-2016-15052Medium 5.4Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Menu System of the web interface.Oct 30, 2025
CVE-2016-15053Medium 5.4Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the “My Reports” listing of the web interface.Oct 30, 2025
CVE-2018-25121Medium 5.4Nagios XI versions prior to 5.4.13 are vulnerable to cross-site scripting (XSS) via the Views page of the web interface.Oct 30, 2025
CVE-2018-25122High 8.8Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page.Oct 30, 2025
CVE-2018-25123High 7.8Nagios XI versions prior to 5.5.7 contain a privilege escalation vulnerability in the MRTG graphing component.Oct 30, 2025
CVE-2020-36856High 8.8Nagios XI versions prior to 5.6.14 contain an authenticated remote command execution vulnerability in the CCM command_test.php script.Oct 30, 2025
CVE-2020-36857High 7.2Nagios XI versions prior to 5.6.14 contain a post-authentication SQL injection vulnerability in the SNMP Trap Interface page.Oct 30, 2025
CVE-2020-36859High 8.8The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple SQL injection vulnerabilities in the object edit pages.Oct 30, 2025
CVE-2020-36860Medium 5.4The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple cross-site scripting (XSS) vulnerabilities in the object edit pages.Oct 30, 2025
CVE-2020-36861Medium 5.4The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.8 / Nagios XI 5.7.5 contains multiple cross-site scripting (XSS) vulnerabilities in the overlay UI elements and the Notification/C…Oct 30, 2025
CVE-2020-36862Medium 6.1Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool.Oct 30, 2025
CVE-2020-36863High 8.8Nagios XI versions prior to 5.7.2 allow PHP files to be uploaded to the Audio Import directory and executed from that location.Oct 30, 2025
CVE-2020-36864Medium 5.4Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the background color settings in Dashboards.Oct 30, 2025
CVE-2020-36865Medium 5.4Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the BPI (Business Process Intelligence) component’s Config Management and Edit Config page.Oct 30, 2025
CVE-2020-36866Medium 5.4Nagios XI versions prior to 5.7.3 are vulnerable to cross-site scripting (XSS) via the Manage Users page of the Admin interface.Oct 30, 2025
CVE-2020-36867High 8.8Nagios XI versions prior to 5.7.3 contain a command injection vulnerability in the report PDF download/export functionality.Oct 30, 2025
CVE-2020-36868High 7.8Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script.Oct 30, 2025
CVE-2020-36869High 7.2Nagios XI versions prior to 5.7.5 contain a SQL injection vulnerability in the SNMP Trap Interface edit page.Oct 30, 2025
CVE-2021-47689Medium 5.4The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.0 / Nagios XI 5.8.0 contais a cross-site scripting (XSS) vulnerability in the Templates pages, specifically in the UI logic that r…Oct 30, 2025
CVE-2021-47690Medium 5.4The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.1 / Nagios XI 5.8.2 contains multiple cross-site scripting (XSS) vulnerabilities in Overlay modals.Oct 30, 2025
CVE-2021-47691Medium 5.4The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.1 / Nagios XI 5.8.2 contains multiple cross-site scripting (XSS) vulnerabilities via the Services page affecting the config_name a…Oct 30, 2025
CVE-2021-47693High 8.8The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.3 / Nagios XI 5.8.5 contains a SQL injection vulnerability in the search text handling.Oct 30, 2025
CVE-2021-47694Medium 6.1The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a reflected cross-site scripting (XSS) vulnerability via the Test Command functionality.Oct 30, 2025
CVE-2021-47695Medium 5.4Nagios XI versions prior to 5.8.0 are vulnerable to stored cross-site scripting (XSS) via the My Tools page.Oct 30, 2025
CVE-2021-47696Medium 5.4Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via BPI config ID handling.Oct 30, 2025
CVE-2021-47697Medium 5.4Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via the Views feature URL handling.Oct 30, 2025
CVE-2021-47699Medium 5.4Nagios XI versions prior to 5.8.7 are vulnerable to cross-site scripting (XSS) via the Audit Log page’s Send to NLS form.Oct 30, 2025
CVE-2021-47700High 7.8Nagios XI versions prior to 5.8.7 used a temporary directory for Highcharts exports with overly permissive ownership/permissions under the Apache user.Oct 30, 2025
CVE-2022-50584Medium 5.4The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.6 / Nagios XI 5.8.8 contains a cross-site scripting (XSS) vulnerability via the search and deletion interfaces.Oct 30, 2025
CVE-2022-50585Medium 5.4The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.7 / Nagios XI 5.8.9 contains a cross-site scripting (XSS) vulnerability via the Audit Log page search input.Oct 30, 2025
CVE-2022-50586Medium 5.4Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the BPI component via the info URL field.Oct 30, 2025
CVE-2022-50587Medium 5.4Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) via the Apply Configuration error text.Oct 30, 2025
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.