CVE-2021-35488
Description
Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it.
NVD
Severity: MEDIUM
CVE ID: CVE-2021-35488
CVSS Score: 6.1
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Proof Of Concept
Nuclei Templates for CVE-2021-35488
Refrence: Project Discovery GitHub