CVE-2018-25121

MediumCVSS 5.4/10Last modified Oct 18, 2026

Description

Nagios XI versions prior to 5.4.13 are vulnerable to cross-site scripting (XSS) via the Views page of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 30, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2018

CVE-2018-251228.8Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handlerCVE-2018-251237.8Nagios XI versions prior to 5.5.7 contain a privilege escalation vulnerability in the MRTG graphing component. MRTG-related processes/scriptCVE-2018-251248.7PacsOne Server version 6.6.2 (prior versions are likely affected) contains a directory traversal vulnerability within the web-based DICOM viCVE-2018-251258.7Netis ADSL Router DL4322D firmware RTK 2.1.1 contains a buffer overflow vulnerability in the embedded FTP service that allows an authenticatCVE-2018-251269.3Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credenCVE-2018-251275.3SOCA Access Control System 180612 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actionCVE-2018-251288.2SOCA Access Control System 180612 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries througCVE-2018-251297.5SOCA Access Control System 180612 contains multiple insecure direct object reference vulnerabilities that allow attackers to access sensitivCVE-2018-251306.2Beward Intercom 2.3.1 contains a credentials disclosure vulnerability that allows local attackers to access plain-text authentication credenCVE-2018-251317.2Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a stored cross-site scripting vulnerability in the configuration file upload funCVE-2018-251326.1MyBB Trending Widget Plugin 1.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through threCVE-2018-251334.3Synaccess netBooter NP-0801DU 7.4 contains a cross-site request forgery vulnerability that allows attackers to perform administrative action
CVE-2018-25121: Medium severity, CVSS 5.4 | Vulnix