CVE-2023-7318

MediumCVSS 5.4/10Last modified Oct 18, 2026

Description

Nagios XI versions prior to < 2024R1.0.2 are vulnerable to cross-site scripting (XSS) via the Nagios Core Command Expansion page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Nagios	XI	< 2024R1.0.2

References

https://www.nagios.com/changelog/nagios-xi/2024r1-0-2/Release Notes
https://www.nagios.com/products/security/#nagios-xiVendor Advisory
https://www.vulncheck.com/advisories/nagios-xi-xss-via-core-command-expansionThird Party Advisory

Timeline

Published: Oct 30, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-73195.4Nagios Network Analyzer versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Percentile Calculator menu. Insufficie CVE-2023-73205.3The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to imprope CVE-2023-73215.4Nagios Log Server versions prior to 2.1.14 are vulnerable to cross-site scripting (XSS) via the Snapshots Page. Untrusted log content was no CVE-2023-73228.1Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission we CVE-2023-73235.4Nagios Log Server versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Create User function. Insufficient validatio CVE-2023-73248.1In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses Sanitize CVE-2023-73259.3Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery (SSRF) vulnera CVE-2023-73268.7The Epson Stylus SX510W embedded web management service fails to properly handle consecutive ampersand characters in query parameters when a CVE-2023-73278.7Ozeki SMS Gateway versions up to and including 10.3.208 contain a path traversal vulnerability. Successful exploitation allows an unauthenti CVE-2023-73285.3Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauth CVE-2023-73298.7Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.CVE-2023-73309.3Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php. The endpoint accept