CVE-2020-36857

HIGH

Nagios XI < 5.6.14 - Authenticated SQL Injection via SNMP Trap Interface Page

Title source: llm
STIX 2.1

Description

Nagios XI versions prior to 5.6.14 contain a post-authentication SQL injection vulnerability in the SNMP Trap Interface page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly sanitized, allowing SQL injection that may lead to unauthorized disclosure or modification of application data or execution of arbitrary SQL commands against the backend database.

References (3)

Core 3
Core References
Release Notes vendor-advisory patch
https://www.nagios.com/products/security/#nagios-xi
Release Notes release-notes patch
https://www.nagios.com/changelog/nagios-xi/

Scores

CVSS v3 7.2
EPSS 0.0022
EPSS Percentile 44.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
nagios/nagios_xi < 5.6.14
Published Oct 30, 2025
Tracked Since Feb 18, 2026