CVE-2018-12520

ntopng is affected by CVE-2018-12520: in versions prior to 3.4.180617, the PRNG used to generate session IDs is not seeded at startup, leading to deterministic session IDs and enabling a remote attacker to hijack user sessions. Public advisories (Ubuntu USN-4842-1, OSV entries) confirm the vulner...

CVE-2017-5473

ntopng Web Interface (ntopng)

CVE-2017-7416

ntopng prior to version 3.0 is affected by an XSS vulnerability caused by improper validation of GET and POST parameters. Affected product is ntopng; the root cause is input parameter validation weakness leading to cross-site scripting. The available documents confirm the existence of this CVE an...

CVE-2017-7459

ntopng before 3.0 is vulnerable to HTTP Response Splitting in HTTP responses. The CVE-2017-7459 entry documents this issue with a high impact (CVSS3 base 7.5) affecting network attack vector and high integrity impact. Exploitation details are not provided in the supplied sources. Remediation: upg...

CVE-2015-8368

Summary: CVE-2015-8368 affects ntopng (ntop) up to version 2.1.x, where remote authenticated users can escalate privileges by tampering with the login flow. The underlying issue allows changing the login context via the user cookie and the username parameter sent to admin/password_reset.lua, effe...

CVE-2017-7458

The CVE-2017-7458 issue affects ntopng prior to version 3.0. The vulnerability is due to NetworkInterface::getHost in NetworkInterface.cpp, where an empty hostname/IP field can cause a NULL pointer dereference, resulting in a denial of service/crash. Affected: ntopng before 3.0. Remediation: upgr...

CVE-2014-5464

CVE-2014-5464 describes an XSS vulnerability in the ntopng/ndpi stack where the HTTP Host header is not sanitized in the web frontend. The issue occurs in ntopng (aka ntop) before version 1.2.1, due to untrusted Host header data being injected into the UI, enabling remote attackers to inject arbi...

CVE-2014-4329

ntopng 1.1 is affected by a Cross-Site Scripting (XSS) vulnerability in lua/host_details.lua, allowing remote attackers to inject arbitrary web script or HTML via the host parameter. The underlying issue is improper input validation in host_details.lua. Affected component/file: host_details.lua w...

CVE-2026-38968

ntopng (through 6.6) is reported vulnerable to a Predictable Session Identifier flaw. The issue occurs in HTTPsession creation within src/HTTPserver.cpp, where time-seeded pseudo-randomness can yield deterministic or colliding cookies, enabling session hijacking under attacker-controlled timing. ...