Cross-Site Scripting Vulnerability in Nagios XI from Nagios
CVE-2016-15054

5.1MEDIUM

Key Information:

Vendor

NagiOS

Status
Xi
Vendor
CVE Published:
3 November 2025

What is CVE-2016-15054?

Nagios XI versions before 5.4.0 have a vulnerability that allows cross-site scripting through the jQuery Migrate library. An attacker may exploit this flaw by supplying unvalidated input, which can lead to the execution of arbitrary scripts in the victim's browser. This breach of client-side security can enable attackers to hijack user sessions or manipulate user interactions with compromised web applications.

Affected Version(s)

XI 0 < 5.4.0

References

https://www.nagios.com/changelog/nagios-xi/
release-notespatch
https://www.vulncheck.com/advisories/nagios-xi-xss-via-jq...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2016-15054 : Cross-Site Scripting Vulnerability in Nagios XI from Nagios