CVE-2021-35488

MEDIUM 6.1CVE-2021-35488 · Published 09/11/2021 · updated 17/06/2026

In short

CVE-2021-35488 is a MEDIUM (CVSS 6.1) vulnerability affecting thruk (thruk).
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 85.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
thruk thruk	`= 2.40-2`	No fix yet

Description

Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it.

References

gruppotim.it/redteam · Exploit
thruk.org/changelog.html · Release Notes

More vulnerabilities in thruk

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free