CVE-2021-35479

Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. This affects users who open a crafted link or third-party web page...

CVE-2020-6584

Nagios Log Server 2.1.3 has Incorrect Access Control...

CVE-2020-6586

Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered...

CVE-2020-25385

Nagios Log Server 2.1.7 contains a cross-site scripting XSS vulnerability in /nagioslogserver/configure/createsnapshot through the snapshotname parameter, which may impact users who open a maliciously crafted link or third-party web page...

CVE-2020-16157

A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods - Email Users menu...

CVE-2020-6585

Nagios Log Server 2.1.3 has CSRF...

CVE-2019-15898

Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page...

CVE-2025-29471

Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field...

CVE-2025-29471

Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field...

CVE-2025-29471

Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field...

CVE-2025-29471

Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field...

CVE-2025-29471

Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field...

Nagios Log Server 安全漏洞

Nagios Log Server is a suite of centralized log management, monitoring, and analysis software from Nagios Corporation. A security vulnerability exists in Nagios Log Server version 2024R1.3.1, which originates from the presence of cross-site scripting in the Email field that could lead to the...

CVE-2025-29471

CVE-2025-29471 is a stored XSS in Nagios Log Server 2024R1.3.1 and earlier, exploitable via payloads in the Email field that can lead to privilege escalation (admin account creation) when an admin views audit logs. Public PoC/Exploits exist (e.g., ExploitDB, PoC video). Affected versions: 2024R1....

PT-2025-16532 · Nagios · Nagios Log Server

Name of the Vulnerable Software and Affected Versions: Nagios Log Server versions 2024R1.3.1 and earlier Description: A Cross Site Scripting vulnerability in Nagios Log Server allows a remote attacker to execute arbitrary code via a payload into the Email field. This issue can be exploited by...

PT-2025-41174

Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 2024R1.3.2 Description Nagios Log Server before version 2024R1.3.2 contains a flaw that allows authenticated users to retrieve cleartext administrative API keys. This is achieved by making a call to the...

📄 Nagios Log Server 2024R1.3.1 Cross Site Scripting

Nagios Log Server versions 2024R1.3.1 and below suffer from a persistent cross site scripting vulnerability. Exploit Title: Stored XSS Vulnerability in Nagios Log Server Privilege Escalation to Admin Date: 2025-04-02 Exploit Author: Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor...

Nagios Log Server 2024R1.3.1 - Stored XSS

Exploit Title: Stored XSS Vulnerability in Nagios Log Server Privilege Escalation to Admin Date: 2025-04-02 Exploit Author: Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link:...

PT-2024-6467 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.852 20230719 Description: A critical issue has been found in the TOTOLINK X6000R, affecting the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument rtLogServer leads to...

CVE-2024-5650

CVE-2024-5650 — Yokogawa CENTUM DLL hijacking affects CENTUM CS 3000 (R3.08.10–R3.09.50) and CENTUM VP (R4.01.00–R4.03.00, R5.01.00–R5.04.20, R6.01.00–R6.11.10). The root cause is improper access control allowing an attacker with local access or shared-folder access to replace a DLL with a tamper...