CVE-2018-8734

9.8 criticalEPSS 54%

Critical (9.8) in nagios nagios xi. EPSS 54% chance of exploitation in the next 30 days.

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 54% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2018-04-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nagios:nagios_xi

References

https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
https://blog.redactedsec.net/exploits/2018/04/26/nagios.html
https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f
https://www.exploit-db.com/exploits/44560/
https://www.exploit-db.com/exploits/44969/

Check your stack JSON