Low severityOSV Advisory· Published Dec 19, 2024· Updated Jun 17, 2026

CVE-2024-9101

Description

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Leenooks/PhpldapadminOSV
Range: RELEASE-0.9.0, RELEASE-0.9.1, RELEASE-0.9.2, …
Phpldapadmin Project/Phpldapadminllm-fuzzy
Range: 1.2.1 - 1.2.6.7

Patches

Vulnerability mechanics

References

github.com/leenooks/phpLDAPadmin/blob/master/htdocs/entry_chooser.phpnvd
github.com/leenooks/phpLDAPadmin/commit/f713afc8d164169516c91b0988531f2accb9bce6nvd
sourceforge.net/projects/phpldapadmin/files/phpldapadmin-php5/1.2.1/nvd
www.redguard.ch/blog/2024/12/19/security-advisory-phpldapadmin/nvd

News mentions

No linked articles in our index yet.

cvss	0.065
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000