Critical severity · published Oct 30, 2025
CVE-2012-10063
Nagios XI < 2012R1.3 Authenticated SQL Injection in Legacy CCM
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database. Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XI
XI · Nagios
before 2012R1.3 · source: vendor
NX
Nagios XI · Nagios
through 2011; 2012; 2012; 2012 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-10063
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-10063
Release Notes
https://www.nagios.com/changelog/nagios-xi/
Third Party Advisory
https://www.vulncheck.com/advisories/nagios-xi-authenticated-sqli-in-legacy-ccm
More from XI
9.8
CVE-2024-13996
Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change
9.8
CVE-2024-14003
Nagios XI < 2024R1.2 RCE via NRDP Server Plugins
9.8
CVE-2024-13994
Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization
9.8
CVE-2024-13999
Nagios XI < 2024R1.1.3 AD/LDAP Token Authenticated Information Disclosure
9.1
CVE-2023-48082
Nagios XI before 2024R1 was discovered to improperly handle API keys generation (randomly-generated), allowing attackers to possibly generate the same set of API keys for all…