CVE-2024-9101lowCWE-79

CVE-2024-9101: low-severity vulnerability in phpLDAPadmin

phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php

Published · Updated

Follow this CVE+ Monitor phpLDAPadmin+ Monitor phpldapadmin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.1epss 0.5%
A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Affected products
phpLDAPadmin · phpLDAPadmin
Related CVEs — phpLDAPadmin

In the same product, most dangerous first.

CVE-2024-9102MEDIUMphpLDAPadmin: Improper Neutralization of Formula ElementsEPSS 0.4%