CVE-2025-39663 HIGH

CVE-2025-39663: Cross Site Scripting through compromised remote site

Vendor Checkmk Gmbh
Product Checkmk
Weakness CWE-80 · XSS · basic
Published October 30, 2025
Last update November 7, 2025
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service outputs in the central site. Affecting Checkmk before 2.4.0p14, 2.3.0p39, 2.2.0 and 2.1.0 (eol).

Key dates

02Disclosure timeline

October 30, 2025 CVE published
November 7, 2025 Record updated