CVE-2020-36869 HIGH

CVE-2020-36869: Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit Page

Vendor Nagios
Product XI
Weakness CWE-89 · SQLi
Published October 30, 2025
Last update November 17, 2025

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Nagios XI versions prior to 5.7.5 contain a SQL injection vulnerability in the SNMP Trap Interface edit page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly sanitized, allowing SQL injection that may lead to unauthorized disclosure or modification of application data or execution of arbitrary SQL commands against the backend database.

Key dates

02Disclosure timeline

October 30, 2025 CVE published
November 17, 2025 Record updated