CVE-2025-29471
HIGHNagios Log Server 2024R1.3.1 - Cross-Site Scripting via Email Field
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-29471. PoCs published by Seth Kraft, skraft9.
AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Nagios Log Server, allowing a low-privileged user to inject malicious JavaScript into their profile's email field. When an administrator views the audit logs, the script executes, creating a new admin account via CSRF token extraction and a POST request to the user creation endpoint.
Description
Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.
Exploits (2)
This exploit demonstrates a stored XSS vulnerability in Nagios Log Server, allowing a low-privileged user to inject malicious JavaScript into their profile's email field. When an administrator views the audit logs, the script executes, creating a new admin account via CSRF token extraction and a POST request to the user creation endpoint.
This PoC demonstrates a stored XSS vulnerability in Nagios Log Server, allowing a low-privileged user to inject malicious JavaScript into their profile's email field. When an administrator views the audit logs, the payload executes, creating a new admin account.
References (3)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H