CVE-2018-25119

MediumCVSS 6.1/10Last modified Oct 18, 2026

Description

Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting (XSS) via the "fusionwindow" parameter. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 30, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-251209.8D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail CVE-2018-251215.4Nagios XI versions prior to 5.4.13 are vulnerable to cross-site scripting (XSS) via the Views page of the web interface. Insufficient valida CVE-2018-251228.8Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler CVE-2018-251237.8Nagios XI versions prior to 5.5.7 contain a privilege escalation vulnerability in the MRTG graphing component. MRTG-related processes/script CVE-2018-251248.7PacsOne Server version 6.6.2 (prior versions are likely affected) contains a directory traversal vulnerability within the web-based DICOM vi CVE-2018-251258.7Netis ADSL Router DL4322D firmware RTK 2.1.1 contains a buffer overflow vulnerability in the embedded FTP service that allows an authenticat CVE-2018-251269.3Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API creden CVE-2018-251275.3SOCA Access Control System 180612 contains a cross-site request forgery vulnerability that allows attackers to perform administrative action CVE-2018-251288.2SOCA Access Control System 180612 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries throug CVE-2018-251297.5SOCA Access Control System 180612 contains multiple insecure direct object reference vulnerabilities that allow attackers to access sensitiv CVE-2018-251306.2Beward Intercom 2.3.1 contains a credentials disclosure vulnerability that allows local attackers to access plain-text authentication creden CVE-2018-251317.2Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a stored cross-site scripting vulnerability in the configuration file upload fun