CVE-2016-15053 Nagios XI < 5.2.4 XSS via “My Reports” Listing

MediumCVSS 5.1 EPSS 0.45%

Published: 2025-10-30 23:54
Updated: 2026-10-18 03:10
Exploit status: No public exploit known

Description

Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the “My Reports” listing of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Affected products

Product	Affected versions	Fixed in
nagios XI	< 5.2.4	5.2.4
nagios xi	< 5.2.4	5.2.4

References

www.nagios.com patch release-notes
www.vulncheck.com third-party-advisory

CVSS v4.0

5.1 Medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: Low
User Interaction: Passive
Vulnerable System Confidentiality: None
Vulnerable System Integrity: None
Vulnerable System Availability: None
Subsequent System Confidentiality: Low
Subsequent System Integrity: Low
Subsequent System Availability: None

All scores (3)

v4.0 5.1 · vulncheck
v4.0 5.1 · disclosure@vulncheck.com
v3.1 5.4 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.45% (percentile 39.3)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.