anonhaven

CVE-2026-48552

MEDIUM CVSS 4.0: 5.1 EPSS 0.17%
Updated Aug 12, 2026
Nagios
Parameter Value
CVSS 5.1 (MEDIUM)
Affected Versions before 4.5.14
Type CWE-79 (Cross-Site Scripting (XSS))
Vendor Nagios
Public PoC No

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browser.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
Passive
Minimal interaction

Impact Assessment

Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v4.0

Weakness Type (CWE)

CWE-79 Cross-Site Scripting (XSS)

Vulnerable Products

nagios enterprises, llc.:nagios xi nagios enterprises, llc.:nagios core

References 3

https://www.nagios.com/security-disclosures/nagios-core/
Security Disclosures
https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog
Changelog
https://www.vulncheck.com/advisories/nagios-core-xi-dom-based-xss-via-jsonquery…
NVD
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-48554

Nagios

7.7

CVE-2026-48553

Nagios

7.7

CVE-2026-48551

Nagios

6.1

CVE-2026-48550

Nagios

5.1

CVE-2026-24893

Nagios

8.8