A SQL injection issue exists in Nagios XI prior to 5.4.13 via the admin/info.php key1 parameter.
nagios nagios xi