ntopng vulnerabilities
4 known CVE vulnerabilities in ntopng, translated and rated.
- CVE-2017-7458High
The NetworkInterface::getHost function in ntopng before version 3.0 allows remote attackers to cause an application crash via a NULL pointer dereference when a field that should contain a hostname or IP address is empty.
- CVE-2017-7459High
Ntopng versions before 3.0 allow HTTP Response Splitting.
- CVE-2017-5473High
CSRF vulnerability in ntopng version 2.4 allows remote attackers to hijack the authentication of arbitrary users. Examples of exploitation include admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.
- CVE-2026-38968Critical
A vulnerability in ntopng up to version 6.6 allows predictable session identifiers, leading to session hijacking. HTTP session IDs are generated using weak time-seeded pseudo-randomness, making them deterministic or collision-prone.