CVE-2021-35488

Thruk 2.40-2 allows /thruk/cgi-bin/status.cgi?style=combined=TITLE Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it...

CVE-2021-35488

creationtimestamp| type| source ---|---|--- 2021-11-10 02:35:28+00:00| seen| https://t.me/cibsecurity/32129 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-35488.yaml...

CVE-2021-35488

Thruk 2.40-2 contains a Cross‑Site Scripting vulnerability in /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE]. The host/title parameter can reflect arbitrary JavaScript, executed in the context of an authenticated user when they view the affected page. This is documented by multiple conne...