CVE-2023-40931

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

11.28% chance of exploitation in the next 30 days, 96th percentile

Nuclei

medium · CWE-89

Published

2023-09-19

Updated

2026-07-09

Proof-of-concept exploits (3)

• G4sp4rCS/CVE-2023-40931-POC0★ · 2025-04-04
• datboi6942/Nagios-XI-s-CVE-2023-40931-Exploit0★ · 2024-12-30
• sealldeveloper/CVE-2023-40931-PoC1★ · 2024-04-27

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40931.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2015-8351
• CVE-2021-43857
• CVE-2022-25012
• CVE-2023-2255
• CVE-2023-32784
• CVE-2026-42980