CVE-2024-13992
31.10.2025, 13:15
Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website. The vulnerable component, page-missing.php, fails to properly validate or escape user-supplied input, allowing an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victims browser within the Nagios XI domain.
| Vendor | Product | Version |
|---|---|---|
| nagios | nagios_xi | 𝑥 < 2024 |
𝑥
= Vulnerable software versions