deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-10072
Published: 2025-10-30
Description: Nagios XI versions prior to 2012R1.6 contain an authorization flaw in the Auto-Discovery functionality. Users with read-only roles could directly reach Auto-Discovery endpoints and pages that should require elevated permissions, exposing discovery results and allowing unintended access to discovery operations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-auto-discovery-missing-authorization
CVE: CVE-2013-10073
Published: 2025-10-30
Description: Nagios XI versions prior to 2012R1.6 contain a shell command injection vulnerability in the Auto-Discovery tool. User-controlled input is passed to a shell without adequate sanitation or argument quoting, allowing an authenticated user with access to discovery functionality to execute arbitrary commands with the privileges of the application service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-auto-discovery-shell-command-injection
CVE: CVE-2013-10074
Published: 2025-10-30
Description: Nagios XI versions prior to 2012R2.6 are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-tools-menu
CVE: CVE-2016-15049
Published: 2025-10-30
Description: Nagios Log Server versions prior to 1.4.2 are vulnerable to cross-site scripting (XSS) in the Dashboards section when rendering log entries in the Logs table. Untrusted log content was not safely encoded for the output context, allowing attacker-controlled data present in logs to execute script in the victim’s browser within the application origin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-log-server-2024r1/; https://www.vulncheck.com/advisories/nagios-log-server-dashboards-logs-table-xss
CVE: CVE-2016-15050
Published: 2025-10-30
Description: Nagios XI versions prior to 5.2.4 contain a SQL injection vulnerability in the notification search functionality. User-supplied search parameters were incorporated into SQL statements without adequate parameterization or sanitation, allowing an authenticated user to manipulate database queries. Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-sqli-in-notification-search
CVE: CVE-2016-15051
Published: 2025-10-30
Description: Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Reports interface through values from the startdate and enddate fields. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-report-startdate-enddate-fields
CVE: CVE-2016-15052
Published: 2025-10-30
Description: Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Menu System of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-menu-system
CVE: CVE-2016-15053
Published: 2025-10-30
Description: Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the “My Reports” listing of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-my-reports-listing
CVE: CVE-2017-20209
Published: 2025-10-30
Description: Nagios Fusion versions prior to 4.0.1 are vulnerable to cross-site scripting (XSS) via the Users and Servers pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-fusion/; https://www.vulncheck.com/advisories/nagios-fusion-xss-via-users-servers-page
CVE: CVE-2018-25119
Published: 2025-10-30
Description: Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting (XSS) via the "fusionwindow" parameter. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-fusion/; https://www.vulncheck.com/advisories/nagios-fusion-xss-via-fusionwindow-parameter
CVE: CVE-2018-25121
Published: 2025-10-30
Description: Nagios XI versions prior to 5.4.13 are vulnerable to cross-site scripting (XSS) via the Views page of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-views-page
CVE: CVE-2018-25122
Published: 2025-10-30
Description: Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler used unsafe command construction with attacker-controlled input and lacked sufficient validation and output encoding, allowing an authenticated user to inject commands or otherwise execute arbitrary code with the privileges of the application service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-component-download-page-rce
CVE: CVE-2018-25123
Published: 2025-10-30
Description: Nagios XI versions prior to 5.5.7 contain a privilege escalation vulnerability in the MRTG graphing component. MRTG-related processes/scripts executed with excessive privileges, allowing a local attacker with limited system access to abuse file/command execution paths or writable resources to gain elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-mrtg-graphing-component
CVE: CVE-2020-36856
Published: 2025-10-30
Description: Nagios XI versions prior to 5.6.14 contain an authenticated remote command execution vulnerability in the CCM command_test.php script. Insufficient validation of the `address` parameter allows an authenticated user with access to the Core Config Manager to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user and may be leveraged to execute commands on the underlying XI host, modify system configuration, or fully compromise the host.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-authenticated-rce-command-test-php-via-address
CVE: CVE-2020-36857
Published: 2025-10-30
Description: Nagios XI versions prior to 5.6.14 contain a post-authentication SQL injection vulnerability in the SNMP Trap Interface page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly sanitized, allowing SQL injection that may lead to unauthorized disclosure or modification of application data or execution of arbitrary SQL commands against the backend database.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-authenticated-sqli-via-snmp-trap-interface-page
CVE: CVE-2020-36858
Published: 2025-10-30
Description: Nagios Log Server versions prior to 2.1.6 contain cross-site scripting (XSS) vulnerabilities via the web interface on the Create User, Edit User, and Manage Host Lists pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-log-server-2024r1/; https://www.vulncheck.com/advisories/nagios-log-server-xss-via-create-user-edit-user-and-manage-host-lists-pages
CVE: CVE-2020-36859
Published: 2025-10-30
Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple SQL injection vulnerabilities in the object edit pages. Unsanitized user-supplied input was incorporated into SQL queries used by configuration object editors, allowing authenticated users to inject SQL fragments. Successful exploitation could lead to unauthorized disclosure or modification of configuration and application data, and in some environments could allow further compromise of the application or backend database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-ccm-sqli-via-object-edit-pages
CVE: CVE-2020-36860
Published: 2025-10-30
Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple cross-site scripting (XSS) vulnerabilities in the object edit pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-object-edit-pages
CVE: CVE-2020-36861
Published: 2025-10-30
Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.8 / Nagios XI 5.7.5 contains multiple cross-site scripting (XSS) vulnerabilities in the overlay UI elements and the Notification/Check Period pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-overlay-rendering-and-notification-check-period-pages
CVE: CVE-2020-36862
Published: 2025-10-30
Description: Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool. Crafted export requests could (1) inject script into exported/returned content due to insufficient output encoding (XSS), and (2) cause the server to fetch attacker-specified URLs (SSRF), potentially accessing internal network resources. An unauthenticated remote attacker can leverage these issues to execute script in a user's browser when the exported content is viewed and to disclose sensitive information reachable from the export server via SSRF.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-918
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-unauthenticated-xss-and-ssrf-via-highcharts
CVE: CVE-2020-36863
Published: 2025-10-30
Description: Nagios XI versions prior to 5.7.2 allow PHP files to be uploaded to the Audio Import directory and executed from that location. The upload handler did not properly restrict file types or enforce storage outside of the webroot, and the web server permitted execution within the upload directory. An authenticated attacker with access to the audio import feature could upload a crafted PHP file and then request it to achieve remote code execution with the privileges of the application service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-unrestricted-file-upload-via-audio-import-directory
CVE: CVE-2020-36864
Published: 2025-10-30
Description: Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the background color settings in Dashboards. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-dashboard-background-color-setting
CVE: CVE-2020-36865
Published: 2025-10-30
Description: Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the BPI (Business Process Intelligence) component’s Config Management and Edit Config page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-bpi-config-management
CVE: CVE-2020-36866
Published: 2025-10-30
Description: Nagios XI versions prior to 5.7.3 are vulnerable to cross-site scripting (XSS) via the Manage Users page of the Admin interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-manage-users-in-admin-interface
CVE: CVE-2020-36867
Published: 2025-10-30
Description: Nagios XI versions prior to 5.7.3 contain a command injection vulnerability in the report PDF download/export functionality. User-supplied values used in the PDF generation pipeline or the wrapper that invokes offline/pdf helper utilities were insufficiently validated or improperly escaped, allowing an authenticated attacker who can trigger PDF exports to inject shell metacharacters or arguments.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-command-injection-in-report-pdf-download
CVE: CVE-2020-36868
Published: 2025-10-30
Description: Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and initialization routines using insecure file/command handling and insufficient validation of attacker-controlled inputs, and in some deployments executed with elevated privileges. A local attacker with low-level access could exploit these weaknesses to cause the script to execute arbitrary commands or modify privileged files, resulting in privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-73, CWE-250
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-insecure-getprofile-script
CVE: CVE-2020-36869
Published: 2025-10-30
Description: Nagios XI versions prior to 5.7.5 contain a SQL injection vulnerability in the SNMP Trap Interface edit page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly sanitized, allowing SQL injection that may lead to unauthorized disclosure or modification of application data or execution of arbitrary SQL commands against the backend database.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-sqli-via-snmp-trap-interface-edit-page
CVE: CVE-2021-47689
Published: 2025-10-30
Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.0 / Nagios XI 5.8.0 contais a cross-site scripting (XSS) vulnerability in the Templates pages, specifically in the UI logic that renders and handles the Active/Actions buttons. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-templates-pages
CVE: CVE-2021-47690
Published: 2025-10-30
Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.1 / Nagios XI 5.8.2 contains multiple cross-site scripting (XSS) vulnerabilities in Overlay modals. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-overlay-modals
CVE: CVE-2021-47691
Published: 2025-10-30
Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.1 / Nagios XI 5.8.2 contains multiple cross-site scripting (XSS) vulnerabilities via the Services page affecting the config_name and service_description fields. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-services-page
CVE: CVE-2021-47692
Published: 2025-10-30
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It has been identified as a duplicate of  https://www.cve.org/CVERecord?id=CVE-2021-33179 .
CVE: CVE-2021-47693
Published: 2025-10-30
Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.3 / Nagios XI 5.8.5 contains a SQL injection vulnerability in the search text handling. Unsanitized user-supplied input was incorporated into SQL queries used by configuration object editors, allowing authenticated users to inject SQL fragments. Successful exploitation could lead to unauthorized disclosure or modification of configuration and application data, and in some environments could allow further compromise of the application or backend database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-ccm-sqli-via-improper-escaping-in-search-text
CVE: CVE-2021-47694
Published: 2025-10-30
Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a reflected cross-site scripting (XSS) vulnerability via the Test Command functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-116
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-ccm-reflected-xss-via-test-command
CVE: CVE-2021-47695
Published: 2025-10-30
Description: Nagios XI versions prior to 5.8.0 are vulnerable to stored cross-site scripting (XSS) via the My Tools page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-my-tools-page
CVE: CVE-2021-47696
Published: 2025-10-30
Description: Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via BPI config ID handling. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-bpi-config-id-handling
CVE: CVE-2021-47697
Published: 2025-10-30
Description: Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via the Views feature URL handling. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-views-url-handling
CVE: CVE-2021-47699
Published: 2025-10-30
Description: Nagios XI versions prior to 5.8.7 are vulnerable to cross-site scripting (XSS) via the Audit Log page’s Send to NLS form. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-in-audit-log-via-send-to-nls-form
CVE: CVE-2021-47700
Published: 2025-10-30
Description: Nagios XI versions prior to 5.8.7 used a temporary directory for Highcharts exports with overly permissive ownership/permissions under the Apache user. Local or co-hosted processes could read/overwrite export artifacts or manipulate paths, risking disclosure or tampering and potential code execution depending on deployment.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-insecure-permissions-on-highcharts-temporary-directory
CVE: CVE-2021-4461
Published: 2025-10-30
Description: Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the `enc` parameter in thirdpartyController.do. The decoded map values can influence session attributes without sufficient authentication/authorization checks, enabling attackers to assign a session to arbitrary user IDs. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-30 at 00:30:40.855917 UTC.
CWE: CWE-306
References: https://github.com/chaitin/xray/blob/f90cf321bc4d294bbf6625a9c4853f3bfdf0a384/pocs/seeyon-oa-cookie-leak.yml; https://github.com/projectdiscovery/nuclei-templates/blob/1ca6b8e6fe225cbd46dcb893dcaee01447afa8c0/http/misconfiguration/seeyon-unauth.yaml#L20; https://mp.weixin.qq.com/s/0AqdfTrZUVrwTMbKEKresg
CVE: CVE-2022-50584
Published: 2025-10-30
Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.6 / Nagios XI 5.8.8 contains a cross-site scripting (XSS) vulnerability via the search and deletion interfaces. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-search-and-deletion-flows