CVE-2024-13992: Nagios XI

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website. The vulnerable component, page-missing.php, fails to properly validate or escape user-supplied input, allowing an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI domain.

Affected products

• Nagios Nagios XI: before 2024 (fixed in 2024); version 2024 only

Published 2025-10-31. Last modified 2026-10-02.