CVE-2024-14006

MediumCVSS 6.1/10Last modified Oct 2, 2026

Description

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published: Oct 30, 2025
Last modified: Oct 2, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-140078.7Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions prior to 1.3.4 conta CVE-2024-140087.2Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient vali CVE-2024-140097.2Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feat CVE-2024-14014.8The Profile Box Shortcode And Widget WordPress plugin before 1.2.1 does not sanitise and escape some of its settings, which could allow high CVE-2024-140109.8Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system comm CVE-2024-140127.3Potential privilege escalation issue in Revenera InstallShield version 2023 R1 running a renamed Setup.exe on Windows. When a local administ CVE-2024-140157.1The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the pag CVE-2024-14024.3Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be CVE-2024-140205.0A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the CVE-2024-140217.8LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_fr CVE-2024-140246.7An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who ha CVE-2024-140256.7An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an