CVE-2026-48552CWE-79cross-site-scripting

CVE-2026-48552

Medium · published August 12, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
20.3
In the wild
Unconfirmed
What it is

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browser.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00289 · 20.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-12T21:17Z
References (3)
https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog · [email protected]https://www.nagios.com/security-disclosures/nagios-core/ · [email protected]https://www.vulncheck.com/advisories/nagios-core-xi-dom-based-xss-via-jsonquery-js · [email protected]
EPSS history
Timeline
  • 12 AUG 16:34Z
    Nagios Core / XI DOM-based XSS via jsonquery.js
    cvelistv5