CVE-2023-22288

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject malicious HTML into Emails

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-138 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-22298.8The Quick Post Duplicator for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 2.0 due CVE-2023-222906.5Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network access CVE-2023-222917.8An invalid free vulnerability exists in the Frame stream parser functionality of Ichitaro 2022 1.0.1.57600. A specially crafted document can CVE-2023-222927.8Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local ac CVE-2023-222938.2Improper access control in the Intel(R) Thunderbolt(TM) DCH drivers for Windows may allow an authenticated user to potentially enable escala CVE-2023-222948.8Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set pe CVE-2023-222955.5Datakit CrossCadWare_x64.dll contains an out of bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT fil CVE-2023-222966.1Reflected cross-site scripting vulnerability in MAHO-PBX NetDevancer series MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MA CVE-2023-222977.8Access of memory location after end of buffer in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to CVE-2023-222986.1Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary CVE-2023-222998.8An OS command injection vulnerability exists in the vtysh_ubus _get_fw_logs functionality of Milesight UR32L v32.3.0.5. A specially crafted CVE-2023-223006.1An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by vie