Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website. The vulnerable component, page-missing.php, fails to properly validate or escape user-supplied input, allowing an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI domain.
Nagios addresses this vulnerability as "Nagios XI is vulnerable to a cross-site scripting (XSS) vulnerability when visiting the "missing page" page from another website" and "Fixed XSS in page-missing.php."