CVE-2026-23928— Stored XSS vulnerability in the Item history/Plain text widget

Stored XSS vulnerability in the Item history/Plain text widget

The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing these widgets. The malicious JavaScript would have to come from a monitored host controlled by the attacker. Note: the Item history widget is a replacement for the Plain text widget since Zabbix 7.0.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Zabbix 跨站脚本漏洞

Zabbix是Zabbix公司的一套开源的监控系统。该系统支持网络监控、服务器监控、云监控和应用监控等。 Zabbix存在跨站脚本漏洞，该漏洞源于Item history widget或Plain text widget在启用HTML显示时可以执行注入的JavaScript，可能导致攻击者根据打开包含这些部件仪表板的用户执行未授权操作。

N/A

N/A