{“lastseen”:””,”description”:”Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk \\u003c2.5.0p5, \\u003c2.4.0p31, \\u003c2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another user interacts with the crafted link.”,”published”:”2026-06-08T12:06:51.267Z”,”modified”:”2026-06-08T12:06:51.267Z”,”type”:”cve”,”title”:”XSS in urls”,”source”:”Checkmk”,”references”:”https:\/\/checkmk.com\/werk\/20002″,”id”:”CVE-2026-8833″,”bulletinFamily”:””,”cwe”:[“CWE-79″],”cvelist”:null,”sourceData”:”Checkmk GmbH Checkmk 2.5.0\\nCheckmk GmbH Checkmk 2.4.0\\nCheckmk GmbH Checkmk 2.3.0\\nCheckmk GmbH Checkmk 2.2.0″,”sourceHref”:””,”cvss”:{“score”:8.5,”severity”:”HIGH”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:A\/VC:H\/VI:H\/VA:H\/SC:N\/SI:L\/SA:N”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Checkmk”,”version”:”2.5.0″,”vendor”:”Checkmk GmbH”,”ai_description”:”Cross-site scripting vulnerability due to improper neutralization of HTML-encoded characters in the URL validation function”,”ai_severity”:”High”,”ai_vendor”:”Checkmk GmbH”,”ai_product”:”Checkmk”,”ai_version”:”2.5.0, 2.4.0, 2.3.0, 2.2.0″,”ai_score”:8.5}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk \\u003c2.5.0p5, \\u003c2.4.0p31, \\u003c2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,44,12,15,13,7,11,5],"class_list":["post-60675","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-85","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n