CVE-2025-34286

Nagios XI

CVE-2025-34286 Nagios XI < 2026R1 RCE via Run Check Command in CCM

Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager CCM Run Check command. Insufficient validation/escaping of parameters used to build backend command lines allows an authenticated administrator to inject shell metacharacters that are...

CVE-2025-34134

CVE-2025-34134 – Nagios XI BPI RCE in pre-2024R1.4.2 . An authenticated administrator can abuse insufficient validation/sanitization of BPI configuration parameters (notably bpi_logfile and bpi_configfile) to create/overwrite files in the webroot and edit them via the BPI editor. If such files ha...

CVE-2025-34134 Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)

Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence BPI component. Insufficient validation and sanitization of administrator-controlled BPI configuration parameters notably bpilogfile and bpiconfigfile allow an authenticated...

CVE-2024-14009 Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile

Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administrative diagnostic/configuration capability. Due to improper access controls and unsafe handling of exported/imported profile data and...

CVE-2024-14009 Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile

Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administrative diagnostic/configuration capability. Due to improper access controls and unsafe handling of exported/imported profile data and...

CVE-2024-14005 Nagios XI < 2024R1.2 Command Injection via Docker Wizard

Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard. Insufficient validation of user-supplied input in the wizard allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful...

EUVD-2025-37201

Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator password...

CVE-2025-34284

CVE-2025-34284 affects Nagios XI versions before 2024R2, via the WinRM plugin. The issue arises from insufficient validation of user-supplied parameters in the WinRM plugin, allowing an authenticated administrator to inject shell metacharacters that are used in backend command invocations. Exploi...

CVE-2025-34280

The CVE-2025-34280 affects Nagios Network Analyzer versions prior to 2024R2.0.1. The LDAP certificate management feature fails to sanitize inputs, enabling an authenticated administrator to trigger remote code execution on the host within the web application service privileges. Impact is remote c...

CVE-2025-34280 Nagios Network Analyzer < 2024R2.0.1 RCE in LDAP Certificate Removal Function

Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal operation fails to apply adequate input sanitation. An authenticated administrator can trigger command execution on the underlying host in...

CVE-2025-63423

Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator password...

GO-2025-4063 Mattermost Server exposes account details to any Team Administrator in github.com/mattermost/mattermost-server

Mattermost Server exposes account details to any Team Administrator in github.com/mattermost/mattermost-server...

GO-2025-4060 Mattermost Server allows System Admin to modify LDAP account names and email addresses in github.com/mattermost/mattermost-server

Mattermost Server allows System Admin to modify LDAP account names and email addresses in github.com/mattermost/mattermost-server...

CVE-2025-43027

CVE-2025-43027 affects Genetec Security Center, with a critical issue in the ALPR Manager role that could allow an attacker to gain administrative access to the system. Public descriptions cite a base score of 9.8 (CVSS v3.1) and network, unauthenticated, no-user-interaction exploitability, causi...

SonicWall SMA100 Potential Exposure of Sensitive Information in Log File

A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administrator, under certain conditions to view partial users credential data.SonicWall strongly recommends that users of the SMA 100 series products SMA 210, 410, an...

CVE-2015-10147

The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2015-10146

The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

Stored Cross-Site Scripting (XSS)

Liferay Portal is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper input validation in the Instance Configuration’s CDN Host HTTP and CDN Host HTTPS text fields, which allows an authenticated instance administrator to inject arbitrary web scripts or HTML into al...

WordPress NS Maintenance Mode for WP plugin <= 1.3.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin NS Maintenance Mode for WP versions = 1.3.1...