CVE-2019-20139: Nagios XI

Medium severity, CVSS 5.4. EPSS: 26.1% chance of exploitation in the next 30 days.

In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.

Affected products

• Nagios Nagios XI: version 5.6.9 only

Published 2019-12-30. Last modified 2026-06-17.