CVE-2024-9101
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2024
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php
A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
phpLDAPadmin
- Vendor
- phpLDAPadmin
- Product
- phpLDAPadmin
- Platforms
- All platforms supporting phpLDAPadmin
- Default status
affected- Package collection
- https://github.com/leenooks/phpLDAPadmin/releases
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1.2.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 1.2.6.7 | affected | Unavailable | Unavailable | Unavailable | None listed |