CVE-2024-13992 | BDVDB-2026-300263 Detail

Description#

Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website. The vulnerable component, page-missing.php, fails to properly validate or escape user-supplied input, allowing an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI domain.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-10-31Record published in the CVE List.
2. Version 22025-11-17Most recent update recorded in the CVE List.