CVE-2025-34283

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-497

Affected software

Vendor	Product	Versions
Nagios	XI	< 2024R1.4.2

References

https://www.nagios.com/changelog/nagios-xi/Release Notes
https://www.nagios.com/products/security/#nagios-xiVendor Advisory
https://www.vulncheck.com/advisories/nagios-xi-api-key-disclosure-via-neptune-themesThird Party Advisory

Timeline

Published: Oct 30, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-342848.8Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied p CVE-2025-342867.2Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insuff CVE-2025-342877.8Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios use CVE-2025-342886.7Nagios XI versions prior to 2026R1.1 are vulnerable to local privilege escalation due to an unsafe interaction between sudo permissions and CVE-2025-34294.9The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'material_text' parameter in all versions up to, and including,CVE-2025-342907.8Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log CVE-2025-342918.8Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An over CVE-2025-342929.4Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of untrusted data. User-co CVE-2025-342938.6GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requ CVE-2025-342978.6KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is CVE-2025-342988.8Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user cou CVE-2025-342999.8Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers