CVE-2021-35488

PoC —

CVSS 3.1

6.1 medium

EPSS

3%p86

Published

Nov 9, 2021 (Nov 9, 2021)

Modified

Jun 17, 2026

Description

Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it.

Vendors: thruk
Products: thruk
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (2.8%)

In the news0 stories

No ingested article mentions this CVE yet.