Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older Browsers
Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI origin. The issue is observable under legacy browser behaviors; modern browsers may mitigate some vectors.
Nagios addresses this vulnerability as "Nagios XI 2024R1.1.1 and earlier may be vulnerable to a reflected XSS in its login page when using older browsers" (within the "Security Disclosures" site) and it's unclear where or if it's addressed within the changelog.