GCVE - cpe:2.3:a:checkmk:checkmk:2.5.0:b2:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:checkmk:checkmk:2.5.0:b2:*:*:*:*:*:*

part: a version: 2.5.0 update: b2

Vendor	Checkmk (`4c044dbb-9ac1-5f9f-8fc3-779e7e40680c`)
Product	Checkmk (`d6ac166c-ac22-5bed-9805-e6ff22774734`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/tribe29/checkmk`	purl2cpe	2026-06-01 10:16:57.801449

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-3466`	vulnerable	2026-06-08 08:01:18.807771	Cross-site scripting in dashlet title Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard. Published: 2026-04-07T12:08:50.132Z Updated: 2026-04-22T12:26:27.839Z Open on db.gcve.eu Reference links https://checkmk.com/werk/19033 https://checkmk.com/werk/19583 https://www.vulncheck.com/advisories/checkmk-stored-cross-site-scripting-in-dashlet-title	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-33457`	vulnerable	2026-06-08 07:59:10.116507	Potential livestatus injection in prediction graph page Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name parameter due to insufficient sanitization of the service description value. Published: 2026-04-10T08:31:35.768Z Updated: 2026-04-14T13:29:41.112Z Open on db.gcve.eu Reference links https://checkmk.com/werk/17990	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-33456`	vulnerable	2026-06-08 07:59:10.047599	Potential livestatus injection in notification test Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with access to the notification test page to inject arbitrary Livestatus commands via a crafted service description. Published: 2026-04-10T08:31:27.807Z Updated: 2026-04-14T13:29:54.362Z Open on db.gcve.eu Reference links https://checkmk.com/werk/17989	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-33455`	vulnerable	2026-06-08 07:59:10.015380	Livestatus injection in monitoring quicksearch Livestatus injection in the monitoring quicksearch in Checkmk <2.5.0b4 allows an authenticated attacker to inject livestatus commands via the search query due to insufficient input sanitization in search filter plugins. Published: 2026-04-10T08:30:20.089Z Updated: 2026-04-14T13:30:16.535Z Open on db.gcve.eu Reference links https://checkmk.com/werk/17988	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-39666`	vulnerable	2026-06-08 07:23:07.036351	omd: Local privilege escalation when executing omd commands as root Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows a site user to escalate their privileges to root, by manipulating files in the site context that are processed when the `omd` administrative command is run by root. Published: 2026-04-07T12:09:07.609Z Updated: 2026-04-07T13:18:19.609Z Open on db.gcve.eu Reference links https://checkmk.com/werk/18891	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.