A reflected cross‑site scripting flaw has been identified in the login field of the Thruk Monitoring web interface. Unauthenticated remote attackers can send specially crafted input through the login form, which is then echoed back in the response without proper neutralisation. This enables attackers to run arbitrary JavaScript in the victim's browser while they view the monitoring dashboard, potentially leading to session hijacking, credential theft, or defacement of the interface.

All installations of Thruk Monitoring through version 2.46.3 are affected; the vulnerability has no vendor‑specific modifiers and applies universally to those releases.

The flaw can be triggered without authentication and only requires access to the monitoring interface’s login page, so the attack vector is remote over HTTP or HTTPS. Exploitation involves submitting a crafted request to the login endpoint and observing the reflected payload. The CVSS score of 6.1 indicates a moderate severity. The EPSS score of 0.00059 (reported as < 1%) shows a very low but non‑zero probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, implying that widespread exploitation is not yet documented.