Nagios Nagios XI

• CVE-2023-24034 Low 3.1 An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability. 1.3%
• CVE-2023-24035 Low 3.5 An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, 0.7%
• CVE-2025-34227 High 8.6 Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection 26.5%
• CVE-2024-13986 High 8.7 Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE 1.7%
• CVE-2021-33179 Unrated The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who accesses a specially crafted malicious URL, 11.7%
• CVE-2021-33177 Unrated The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but on 10.1%