{"id":"CVE-2025-34278","title":"Nagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page (percentile calculator menu). An attacker can supply a malicious payload which is stored by the applicat…","summary":"Nagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page (percentile calculator menu). An attacker can supply a malicious payload which is stored by the applicat…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"nagios","product":"network_analyzer","affected":["network_analyzer < 2024"],"patched":["network_analyzer 2024"],"published":"2025-10-30","updated":"2026-10-07","sourceUpdated":"2026-10-07T21:10:00.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-34278","references":[{"url":"https://www.nagios.com/changelog/#network-analyzer","label":"disclosure@vulncheck.com"},{"url":"https://www.nagios.com/products/security/#network-analyzer","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/nagios-network-analyzer-source-groups-percentile-calculator-menu-stored-xss","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00756,"epssPercentile":0.53732,"ingestedAt":"2026-10-07T21:54:14.906Z","slug":"CVE-2025-34278","body":"## Overview\n\nNagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page (percentile calculator menu). An attacker can supply a malicious payload which is stored by the application and later rendered in the context of other users. When a victim views the affected page the injected script executes in the victim's browser context.\n\n## Affected\n\n- `network_analyzer < 2024`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `network_analyzer 2024`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}