CVE-2019-12279

Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the issue with no luck

• CWE-89

• http://packetstormsecurity.com/files/153040/Nagios-XI-5.6.1-SQL-Injection.html
• http://www.securityfocus.com/bid/108446
• https://github.com/JameelNabbo/exploits/blob/master/nagiosxi%20username%20sql%20injection.txtExploit, Third Party Advisory
• http://packetstormsecurity.com/files/153040/Nagios-XI-5.6.1-SQL-Injection.html
• http://www.securityfocus.com/bid/108446
• https://github.com/JameelNabbo/exploits/blob/master/nagiosxi%20username%20sql%20injection.txtExploit, Third Party Advisory

Published

May 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12272In OpenWrt LuCI through 0.10, the endpoints admin/status/rea…
• CVE-2019-12273OutSystems Platform 10 through 11 allows ImageResourceDetail…6.5
• CVE-2019-12274In Rancher 1 and 2 through 2.2.3, unprivileged users (if all…
• CVE-2019-12276A Path Traversal vulnerability in Controllers/LetsEncryptCon…
• CVE-2019-12277Blogifier 2.3 before 2019-05-11 does not properly restrict A…
• CVE-2019-12278Opera through 53 on Android allows Address Bar Spoofing. Cha…4.3
• CVE-2019-1228An information disclosure vulnerability exists when the Wind…5.5
• CVE-2019-12280PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path…
• CVE-2019-12288An issue was discovered in upgrade_htmls.cgi on VStarcam 100…9.8
• CVE-2019-12289An issue was discovered in upgrade_firmware.cgi on VStarcam …
• CVE-2019-1229An elevation of privilege vulnerability exists in Dynamics O…
• CVE-2019-12290GNU libidn2 before 2.2.0 fails to perform the roundtrip chec…7.5