CVE-2026-20915CWE-79

Stored cross-site scripting in Pending Changes sidebar

High · published March 31, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
3.6
In the wild
Unconfirmed
What it is

Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar, which will execute in the browsers of other users viewing the sidebar.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N
EPSS
0.00147 · 3.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-31T13:51Z
EPSS history
Timeline
  • 31 MAR 13:51Z
    Stored cross-site scripting in Pending Changes sidebar
    cvelistv5