CVE-2020-36869: Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit Page

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-30 · updated 2026-10-18
Weakness: CWE-89

Description

Nagios XI versions prior to 5.7.5 contain a SQL injection vulnerability in the SNMP Trap Interface edit page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly sanitized, allowing SQL injection that may lead to unauthorized disclosure or modification of application data or execution of arbitrary SQL commands against the backend database.

Affected products

Nagios XI: before 5.7.5 — fixed in 5.7.5

How to fix

Upgrade to a fixed version: Nagios XI 5.7.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-36869 or the next vulnerability affects your stack