Log Server vulnerabilitiesRanked by how likely they are to be used.
Log Server is made by Nagios. We track 22 published vulnerabilities in it, across 23 versions. None of them is on the list of flaws known to be exploited today. If you run Log Server, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Log Server vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Log Server's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Log Server flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 77%CVE-2021-35478Medium
Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function.
- 16%CVE-2020-25385Medium
Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, which may impact users who open a maliciously crafted...
- 16%CVE-2025-44823Critical
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call.
- 14%CVE-2020-16157Medium
A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu.
- 13%CVE-2021-35479Medium
Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter.
- 7.3%CVE-2025-29471High
Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.
- 2.8%CVE-2025-44824High
Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call.
- 2.2%CVE-2025-34277Critical
Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before being forwarded to an internal API.
- 2.1%CVE-2025-34274Critical
Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user.
- 1.6%CVE-2019-15898Medium
Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page.
Running Log Server? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page.
- Matched to
- Log Server on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 22 published vulnerabilities listed under the name Log Server, across 23 versions.
None of Log Server's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Log Server. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.