CVE-2025-29471

Deeper analysis

CVE-2025-29471 is a cross-site scripting vulnerability, tracked under CWE-79, that affects Nagios Log Server version 2024R1.3.1. The flaw resides in the Email field and permits injection of malicious payloads that result in arbitrary code execution, reflected in the CVSS 8.3 rating driven by network attack vector, high complexity, no required privileges, and required user interaction with changed scope.

A remote attacker can supply a crafted payload through the Email field to trigger the vulnerability. Successful exploitation enables the attacker to execute arbitrary code in the context of an affected user's session, potentially leading to full confidentiality, integrity, and availability impacts on the Nagios Log Server instance.

The Nagios changelog reference indicates the availability of version updates that address the issue. Public exploit code has been published on Exploit-DB, and the EPSS score has reached a peak of 0.2008 with a current value of 0.1822, indicating measurable post-disclosure interest in the flaw.