CVE-2025-67255

In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.

high 8.8 CVSS 3.1

Published: Dec 29, 2025

Modified: Jan 15, 2026

Vendor: Nagios

Versions: 2026

Description

In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.

References

https://github.com/YongYe-Security/NagiosXI/tree/main
https://www.nagios.org/

Related CVEs

CVSS Breakdown

Version	3.1
Score	8.8 / 10
Severity	high

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness (CWE)

CWE-89

Affected Product

Vendor	Nagios
Product	Nagios Xi
Versions	2026