PT-2026-71151 · Nagios Enterprises+3 · Nagios Core+2
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Nagios Core versions prior to 4.5.14
Nagios XI versions prior to 2026R1.7
Description
DOM-based cross-site scripting occurs in
jsonquery.js when unencoded JSON string values reflected from stored fields are inserted into the Document Object Model (DOM) without proper sanitization. This allows attackers to execute arbitrary JavaScript in the browser of a victim.Recommendations
Update Nagios Core to version 4.5.14 or later.
Update Nagios XI to version 2026R1.7 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nagios Core
Nagios Xi
Nagios4