PT-2025-12975

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.11.5 Icinga Web 2 versions prior to 2.12.3 Description A vulnerability in Icinga Web 2 allows an attacker to craft a URL that, once visited by an authenticated user, manipulates the backend to redirect the user...

PT-2025-12941

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.11.5 Icinga Web 2 versions prior to 2.12.13 Description A vulnerability in Icinga Web 2 allows an attacker to craft a URL that, once visited by any user, enables the embedding of arbitrary Javascript into Icing...

PT-2025-12970

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.11.5 Icinga Web 2 versions prior to 2.12.13 Description A vulnerability in Icinga Web 2 allows an attacker to craft a URL that, once visited by any user, enables the embedding of arbitrary Javascript into Icing...

Icinga Web 2 Cross-Site Scripting Vulnerabilities

Icinga Web 2 is an open source monitoring and metrics solution from Icinga Open Source. A cross-site scripting vulnerability exists in Icinga Web 2 versions prior to 2.11.5 and prior to 2.12.13, which stems from embeddable arbitrary Javascript that could lead to user identity impersonation...

PT-2025-12974

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.11.5 Icinga Web 2 versions prior to 2.12.13 Description A vulnerability in Icinga Web 2 allows an attacker to craft a request that embeds arbitrary Javascript into the interface, enabling them to act on behalf ...

CVE-2025-30164: URL Redirection to Untrusted Site

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user or one that is able to authenticate, allows to...

CVE-2025-27406: Improper Neutralization of Input During Web Page Generation

Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascript. This enables the attacker to act...

CVE-2025-27405: Improper Neutralization of Input During Web Page Generation

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of tha...

CVE-2025-27404: Improper Neutralization of Input During Web Page Generation

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of tha...

CVE-2025-23203: Exposure of Sensitive Information to an Unauthorized Actor

Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.4 and 1.11.4 on several director endpoints of REST API. To reproduce this vulnerability an authenticated user with permission to access the Director is required...

Icinga Web 2 Cross-Site Scripting Vulnerabilities

Icinga Web 2 is an open source monitoring and metrics solution from Icinga Open Source. A cross-site scripting vulnerability exists in Icinga Web 2 versions prior to 2.11.5 and prior to 2.12.13, which stems from embeddable arbitrary Javascript that could lead to user identity impersonation...

Icinga Reporting code-related vulnerabilities

Icinga Reporting is an Icinga open source component that is a core component for reporting related functionality in Icinga web 2. A code issue vulnerability exists in Icinga Reporting versions 0.10.0 through 1.0.2 and earlier, which stems from embeddable arbitrary Javascript and could lead to use...

Icinga Web 2 Cross-Site Scripting Vulnerabilities

Icinga Web 2 is an open source monitoring and metrics solution from Icinga Open Source. A cross-site scripting vulnerability exists in Icinga Web 2 versions prior to 2.11.5 and prior to 2.12.13, which stems from embeddable arbitrary Javascript that could lead to user identity impersonation...

Icinga Web 2: Input Validation Error Vulnerability

Icinga Web 2 is an open source monitoring and metrics solution from Icinga Open Source. An input validation error vulnerability exists in Icinga Web 2 versions prior to 2.11.5 and prior to 2.12.13, which stems from constructible URLs that result in redirection to an arbitrary location...

Icinga Director Access Control Vulnerability

Icinga Director is an Icinga configuration and deployment tool from Icinga Open Source. An access control error vulnerability exists in Icinga Director version 1.0.0 and earlier, which stems from an improperly access controlled REST API endpoint that could lead to information disclosure and...

CVE-2025-27609: Improper Neutralization of Input During Web Page Generation

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a request that, once transmitted to a victim's Icinga Web, allows to embed arbitrary Javascript into it and to act on...

PT-2025-12889

Name of the Vulnerable Software and Affected Versions Icinga Director versions 1.0.0 through 1.10.2 Icinga Director versions 1.0.0 through 1.11.2 Description A security issue has been found in Icinga Director, affecting several REST API endpoints. This issue allows authenticated users with...

Linux Distros Unpatched Vulnerability : CVE-2024-24820

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the...

Linux Distros Unpatched Vulnerability : CVE-2022-24714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affecte...

Linux Distros Unpatched Vulnerability : CVE-2022-24715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create...