CVE-2025-34278

Nagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page (percentile calculator menu). An attacker can supply a malicious payload which is stored by the application and later rendered in the context of other users. When a victim views the affected page the injected script executes in the victim's browser context.

Stored XSS may allow an attacker to steal sessions, take over accounts, or perform actions on behalf of the victim. This may lead to a compromise of the entire application.

Update Nagios Network Analyzer to version 2024R1 or later. Check whether any malicious payloads have already been injected into the system.