CVE-2020-28900

CVE-2020-28900 affects Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier. The root cause is insufficient verification of data authenticity, enabling privilege escalation or code execution via an untrusted update package (upgrade_to_latest.sh). Documented impact includes escalation t...

CVE-2020-28906

CVE-2020-28906 affects Nagios XI <= 5.7.5 and Nagios Fusion

CVE-2020-28905

Nagios Fusion (versions 4.1.8 and earlier) is affected by CVE-2020-28905 due to improper input validation in the Fusion component that handles table pagination. An authenticated attacker can remotely execute arbitrary code on the affected system, as described in multiple connected advisories (RCE...

CVE-2020-28901

CVE-2020-28901 affects Nagios Fusion 4.1.8 and earlier. The vulnerability is a command injection in the Fusion component, specifically in the cmd_subsys.php path, enabling privilege escalation from apache to root (and potential code execution) via a corrupt component installation vector. Document...

CVE-2020-28904

Summary: CVE-2020-28904 affects Nagios Fusion 4.1.8 and earlier, enabling privilege escalation for user nagios via installation of a malicious component containing PHP code. The description specifies execution with unnecessary privileges to escalate to nagios. The connected documents corroborate ...

CVE-2020-28911

CVE-2020-28911 concerns Nagios Fusion 4.1.8 and earlier, where an incorrect access control flaw allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php. The issue is described consistently across sources (Red Hat an...

CVE-2023-7312

Nagios Fusion is affected by a stored XSS in Email Settings for versions prior to 4.2.0. The vulnerability arises from insufficient input sanitization, allowing unsanitized input to be stored and later rendered in the administrative UI, enabling JavaScript execution in the browsers of users viewi...

CVE-2020-28903

Nagios Fusion 4.1.8 and earlier are affected by an XSS vulnerability due to improper input validation. A remote attacker who controls a fused server can inject arbitrary HTML into the Fusion server context. This is documented across multiple sources (Red Hat CVE entry, NVD/NASL references, CNVD/C...

CVE-2020-28907

Nagios Fusion

CVE-2018-12501

Nagios Fusion prior to 4.1.4 is affected by a cross-site scripting (XSS) vulnerability (CVE-2018-12501) in the web interface. The issue, also referred to as TPS#13332-13335, is documented across multiple sources (Red Hat, CNVD, NVD, CVE lists). The vulnerability arises in Nagios Fusion’s handling...

CVE-2020-28902

CVE-2020-28902 affects Nagios Fusion 4.1.8 and earlier. The issue is a command injection in cmd_subsys.php that permits privilege escalation from apache to root. Red Hat and NVD references corroborate the description. Connected sources do not provide concrete exploit details beyond the function/f...

CVE-2020-28908

Nagios Fusion 4.1.8 and earlier are affected by a command injection vulnerability in cmd_subsys.php that allows privilege escalation from the Apache user to Nagios. Multiple sources (NVD entry CVE-2020-28908; Red Hat advisory; Nessus plugin for Nagios Fusion

CVE-2020-28909

CVE-2020-28909 — Nagios Fusion (4.1.8 and earlier) is affected by a privilege-escalation issue where low-privilege users can modify scripts that are executable via sudo, enabling escalation to root. The description and related sources confirm the root cause as script modification, with high impac...

CVE-2025-60425

Nagios Fusion versions v2024R1.2 and v2024R2 are vulnerable to a session hijacking attack because the application fails to invalidate existing session tokens when two-factor authentication (2FA) is enabled. This flaw allows attackers to bypass the intended security upgrade, as old sessions remain...

CVE-2025-60424

Nagios Fusion versions v2024R1.2 and v2024R2 are vulnerable to an authentication bypass due to a lack of rate limiting in the OTP verification component. Attackers can exploit this by using automated scripts to perform brute-force attacks against endpoints such as /verify-otp , repeatedly guessin...

CVE-2023-53689

Nagios Fusion

CVE-2017-20209

Nagios Fusion prior to version 4.0.1 is vulnerable to cross-site scripting (XSS) via the Users and Servers pages. The issue arises from insufficient validation or escaping of user-supplied input, potentially allowing an attacker to inject and execute arbitrary script in a victim’s browser. The pr...

CVE-2023-53690

Nagios Fusion (versions prior to 4.2.0) is affected by a stored XSS vulnerability in the LDAP/AD authentication-server configuration. The flaw arises from unsanitized input that can be stored and later rendered in the administrative UI, causing JavaScript execution in users’ browsers when viewing...

CVE-2018-25119

CVE-2018-25119 affects Nagios Fusion versions prior to 4.1.5. The issue is a cross-site scripting (XSS) vulnerability due to insufficient validation/escaping of the fusionwindow parameter, allowing attacker-supplied script to run in a victim’s browser. Affected software is disclosed across multip...