CVE-2025-29471

This exploit demonstrates a stored XSS vulnerability in Nagios Log Server, allowing a low-privileged user to inject malicious JavaScript into their profile's email field. When an administrator views the audit logs, the script executes, creating a new admin account via CSRF token extraction and a POST request to the user creation endpoint.

This PoC demonstrates a stored XSS vulnerability in Nagios Log Server, allowing a low-privileged user to inject malicious JavaScript into their profile's email field. When an administrator views the audit logs, the payload executes, creating a new admin account.