Vulnerability · Published Oct 31, 2025 · Assigned by VulnCheck

CVE-2024-13992Nagios XI < 2024R1.1 XSS via Missing Page / 404

Medium 5.1

In plain English

A medium-severity cross-site scripting in XI from Nagios. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.6%top 51.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website. The vulnerable component, page-missing.php, fails to properly validate or escape user-supplied input, allowing an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI domain.

Affected products (as reported)

Vendor	Product	Versions
Nagios	XI	0 – before 2024R1.1

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://www.nagios.com/products/security/#nagios-xi vendor-advisory, patch
https://www.nagios.com/changelog/nagios-xi/2024r1-1/ release-notes, patch
https://www.vulncheck.com/advisories/nagios-xi-xss-via-missing-page third-party-advisory