PT-2026-71151

CVE-2026-48552

Published

2026-08-12

Updated

2026-08-12

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nagios Core versions prior to 4.5.14 Nagios XI versions prior to 2026R1.7

Description DOM-based cross-site scripting occurs in jsonquery.js when unencoded JSON string values reflected from stored fields are inserted into the Document Object Model (DOM) without proper sanitization. This allows attackers to execute arbitrary JavaScript in the browser of a victim.

Recommendations Update Nagios Core to version 4.5.14 or later. Update Nagios XI to version 2026R1.7 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Zach Hanley

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers