CVE-2021-32812

Monkshu is an enterprise application server for mobile apps (iOS and Android), responsive HTML 5 apps, and JSON API services. In version 2.90 and earlier, there is a reflected cross-site scripting vulnerability in frontend HTTP server. The attacker can send in a carefully crafted URL along with a known bug in the server which will cause a 500 error, and the response will then embed the URL provided by the hacker. The impact is moderate as the hacker must also be able to craft an HTTP request which should cause a 500 server error. None such requests are known as this point. The issue is patched in version 2.95. As a workaround, one may use a disk caching plugin.

• CWE-79
• CWE-116
• CWE-79
• CWE-116

• https://github.com/TekMonksGitHub/monkshu/commit/4601a9bfdc934d7ac32619ce621652fad0cf452bPatch, Third Party Advisory
• https://github.com/TekMonksGitHub/monkshu/releases/tag/v2.95Third Party Advisory
• https://github.com/TekMonksGitHub/monkshu/security/advisories/GHSA-hcpx-66hq-7g4xThird Party Advisory
• https://github.com/TekMonksGitHub/monkshu/commit/4601a9bfdc934d7ac32619ce621652fad0cf452bPatch, Third Party Advisory
• https://github.com/TekMonksGitHub/monkshu/releases/tag/v2.95Third Party Advisory
• https://github.com/TekMonksGitHub/monkshu/security/advisories/GHSA-hcpx-66hq-7g4xThird Party Advisory

Published

Aug 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32807The module `AccessControl` defines security policies for Pyt…7.2
• CVE-2021-32808ckeditor is an open source WYSIWYG HTML editor with rich con…5.4
• CVE-2021-32809ckeditor is an open source WYSIWYG HTML editor with rich con…5.4
• CVE-2021-3281In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 befo…5.3
• CVE-2021-32810crossbeam-deque is a package of work-stealing deques for bui…9.8
• CVE-2021-32811Zope is an open-source web application server. Zope versions…7.2
• CVE-2021-32813Traefik is an HTTP reverse proxy and load balancer. Prior to…8.1
• CVE-2021-32814Skytable is a NoSQL database with automated snapshots and TL…8.1
• CVE-2021-32815Exiv2 is a command-line utility and C++ library for reading,…5.5
• CVE-2021-32816ProtonMail Web Client is the official AngularJS web client f…7.5
• CVE-2021-32817express-hbs is an Express handlebars template engine. expres…6.8
• CVE-2021-32818haml-coffee is a JavaScript templating solution. haml-coffee…5.4