CVE-2025-67255
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability. This can lead to unauthorized database access.
Risk Assessment
An authenticated attacker can execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. The risk is high as it requires only basic authentication.
Recommendation
Update NagiosXI to a version containing the fix or implement parameter filtering patches. Additionally, apply the principle of least privilege for user accounts.
Other vulnerabilities in NagiosXI
See all- CVE-2021-37223Medium
An SSRF vulnerability in NagiosXI up to version 5.8.4 allows authenticated users to create scheduled reports with PDF screenshots of any view. Lack of input sanitization enables replacing the target page with an SSRF payload.
- CVE-2025-67254High
NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php. The vulnerability allows access to files outside the intended directory.
Original NVD description (English source)
In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS