PT-2026-29251

CVE-2026-20915

·

Published

2026-03-31

·

Updated

2026-07-25

Description by

CVSS 4.0
8.5
High
MetricsAV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N
Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.5.0b2
Description A stored cross-site scripting issue exists in Checkmk. Authenticated users with permission to create pending changes can inject malicious JavaScript into the Pending Changes sidebar. This injected script will then execute in the browsers of other users who view the sidebar. The vulnerable component is the Pending Changes sidebar.
Recommendations Update to version 2.5.0b2 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2026-20915
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com