Skip to content
OpenAdvisories
Medium WID-SEC-2026-1375 3 CVEs

Zabbix: Mehrere Schwachstellen

Published May 5, 2026 · Updated May 6, 2026 · Revision 2 · de-DE

Vendor: Zabbix Product: Zabbix Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Zabbix ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, und um Informationen offenzulegen.

Product

Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.

Vulnerabilities 3

  • High 7.3
    CVE-2026-23926

    Stored XSS vulnerability in Host navigator widget maintenance tooltip

    An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized …

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • High 7.3
    CVE-2026-23928

    Stored XSS vulnerability in the Item history/Plain text widget

    The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing the…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Medium 5.1
    CVE-2026-23927

    Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter

    A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-27530, EUVD-2026-27528, EUVD-2026-27527

  2. #1

    Initiale Fassung

References