VULNERABILITY INTELLIGENCE

CVE-2023-40931

CVSS score6.5 MEDIUM
EPSS probability11.87%
CISA KEVNot currently listed
Published2023-09-19
Last modified2026-07-09
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php

Weakness classification

  • nvd@nist.gov: CWE-89

Primary references