CVE-2012-10029: nagios enterprises nagios xi graph explorer OS Command Injection

CVSS: 8.6v4.0HighDeferred

Published 05-08-2025Last modified 15-05-2026

Vulnerability summary

CVE-2012-10029 is a high (CVSS 8.6) OS Command Injection vulnerability in nagios enterprises nagios xi graph explorer. EPSS estimates a 3.59% chance of exploitation in the next 30 days, higher than 89.3% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk

45/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.6/10

010

High · v4.0 (CVE.org)

EPSS score

3.59%

0%100%

Low · +1.08 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits4exploit-database, reference, metasploit

Timeline

05-08-2025
PublishedVulnerability first disclosed.
15-05-2026
Last modifiedVulnerability information updated.

Description

Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`. An authenticated user can inject system commands via unsanitized parameters such as `host`, resulting in remote code execution.

CVSS metrics

2 scores · 2 sources · 1 version

v4.08.6

EPSS trend

Probability

3.59%

Chance of exploitation in the next 30 days

Percentile

89%

Versus all other CVEs

30-day change

+1.08 pp

From 2.51% on 20-09-2026

20-09-202620-10-2026

EPSS score

3.59%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found

exploit-databaseremoteunixVerified
Nagios XI Network Monitor Graph Explorer Component - Command Injection (Metasploit)
Maturity: weaponized
referenceUnverified
Exploit Reference (raw.githubusercontent.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstorm.news)
Maturity: unknown

Show all 4 exploits

MetasploitremoteVerified
Nagios XI Network Monitor Graph Explorer Component Command Injection
exploit/unix/webapp/nagios_graph_explorer
Maturity: weaponized