EUVD-2025-36198

Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack...

CVE-2025-60425

Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack...

CVE-2025-60424

Nagios Fusion versions v2024R1.2 and v2024R2 are vulnerable to an authentication bypass due to a lack of rate limiting in the OTP verification component. Attackers can exploit this by using automated scripts to perform brute-force attacks against endpoints such as /verify-otp , repeatedly guessin...

CVE-2025-60425

Nagios Fusion versions v2024R1.2 and v2024R2 are vulnerable to a session hijacking attack because the application fails to invalidate existing session tokens when two-factor authentication (2FA) is enabled. This flaw allows attackers to bypass the intended security upgrade, as old sessions remain...

CVE-2025-60425

Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack...

Nagios Fusion 安全漏洞

Nagios Fusion is a centralized monitoring and visualization platform from the US-based Nagios, Inc. A security vulnerability exists in Nagios Fusion versions v2024R1.2 and v2024R2 that stems from failure to invalidate an existing session token when enabling two-factor authentication, which could...

CVE-2025-60424

A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack...

PT-2025-34786 · Nagios Enterprises · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI version 2024R2 Description: A cross-site scripting XSS vulnerability exists that allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session via a specially crafted URL. The issue resides in ...