What’s Vulnerable › Vulnerabilities

CVE-2020-36857: Nagios XI < 5.6.14 Authenticated SQL Injection via SNMP Trap Interface Page

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-30 · updated 2026-10-18
• Weakness: CWE-89

Description

Nagios XI versions prior to 5.6.14 contain a post-authentication SQL injection vulnerability in the SNMP Trap Interface page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly sanitized, allowing SQL injection that may lead to unauthorized disclosure or modification of application data or execution of arbitrary SQL commands against the backend database.

Affected products

• Nagios XI: before 5.6.14 — fixed in 5.6.14

How to fix

Upgrade to a fixed version: Nagios XI 5.6.14. Check the vendor advisory for mitigations.

References

• https://www.nagios.com/changelog/nagios-xi/
• https://www.nagios.com/products/security/#nagios-xi
• https://www.vulncheck.com/advisories/nagios-xi-authenticated-sqli-via-snmp-trap-interface-page

Get alerted when CVE-2020-36857 or the next vulnerability affects your stack