What’s Vulnerable › Vulnerabilities

CVE-2024-13993: Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older Browsers

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-30 · updated 2026-10-02
• Weakness: CWE-79

Description

Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI origin. The issue is observable under legacy browser behaviors; modern browsers may mitigate some vectors.

Affected products

• Nagios XI: before 2024; 2024-r1, 2024-r1.0.1, 2024-r1.1, 2024-r1.1.1 — fixed in 2024

How to fix

Upgrade to a fixed version: Nagios XI 2024. Check the vendor advisory for mitigations.

References

• https://www.nagios.com/changelog/nagios-xi/
• https://www.nagios.com/products/security/#nagios-xi
• https://www.vulncheck.com/advisories/nagios-xi-reflected-xss-via-login-page-on-older-browsers

Get alerted when CVE-2024-13993 or the next vulnerability affects your stack