CVE-2021-40906

CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication.

• CWE-79

• https://github.com/Edgarloyola/CVE-2021-40906Third Party Advisory
• https://github.com/Edgarloyola/CVE-2021-40906Third Party Advisory

Published

Mar 25, 2022

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40900A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40901A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40902flatCore-CMS version 2.0.8 is affected by Cross Site Scripti…5.4
• CVE-2021-40903A vulnerability in Antminer Monitor 0.50.0 exists because of…9.8
• CVE-2021-40904The web management console of CheckMK Raw Edition (versions …8.8
• CVE-2021-40905The web management console of CheckMK Enterprise Edition (ve…8.8
• CVE-2021-40907SQL injection vulnerability in Sourcecodester Storage Unit R…9.8
• CVE-2021-40908SQL injection vulnerability in Login.php in Sourcecodester P…9.8
• CVE-2021-40909Cross site scripting (XSS) vulnerability in sourcecodester P…9.6
• CVE-2021-4091A double-free was found in the way 389-ds-base handles virtu…7.5
• CVE-2021-40910There is a reflective cross-site scripting (XSS) vulnerabili…6.1
• CVE-2021-4092yetiforcecrm is vulnerable to Cross-Site Request Forgery (CS…4.3