https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 14:56:40 +0000 https://cve.radiocsirt.org/vuln/cve-2025-34322 <p><strong>Affected:</strong> Nagios Log Server</p> <p>Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental &#39;Natural Language Queries&#39; feature. When this feature is configured, certain user-controlled settings—including model selection and connection parameters—are read from the global configuration and concatenated into a shell command that is executed via shell_exec() without proper input handling or command-line argument sanitation. An authenticated user with access to the &#39;Global Settings&#39; page can supply crafted values in these fields to inject additional shell commands, resulting in arbitrary command execution as the &#39;www-data&#39; user and compromise of the Log Server host.</p> <p><strong>Affected:</strong> Nagios Log Server</p> <p>Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental &#39;Natural Language Queries&#39; feature. When this feature is configured, certain user-controlled settings—including model selection and connection parameters—are read from the global configuration and concatenated into a shell command that is executed via shell_exec() without proper input handling or command-line argument sanitation. An authenticated user with access to the &#39;Global Settings&#39; page can supply crafted values in these fields to inject additional shell commands, resulting in arbitrary command execution as the &#39;www-data&#39; user and compromise of the Log Server host.</p> https://cve.radiocsirt.org/vuln/cve-2025-34322