A reflected cross‑site scripting vulnerability exists in the login field of the Thruk Monitoring web interface. Unauthenticated remote attackers can submit crafted input through the login form, causing the input to be reflected in the response without proper neutralisation. This flaw permits execution of arbitrary client‑side code in the context of the victim’s browser used to view the monitoring interface.

All installations of Thruk Monitoring up to and including version 2.46.3 are affected. No specific vendor modifiers are listed.

The flaw can be triggered without authentication and only requires access to the monitoring interface’s login page, making the attack vector remote over HTTP or HTTPS. Exploitation involves sending a specially crafted request to the login endpoint and observing the reflected user code. While the CVSS score is not supplied, the presence of reflected XSS indicates significant potential for client‑side script execution. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not yet documented but the risk remains notable for exposed monitoring systems.