{
  "cveId": "CVE-2024-9101",
  "url": "https://patchblox.com/security/cve/CVE-2024-9101",
  "summary": "CVE-2024-9101 is fixed in phpldapadmin on 1 platform, first by DEBIAN-CVE-2024-9101, released December 19, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "phpldapadmin: A reflected cross-site scripting (XSS) vulnerability in the \u0027Entry Chooser\u0027 of phpLDAPadmin (version 1.2.1 through th...",
  "description": "A reflected cross-site scripting (XSS) vulnerability in the \u0027Entry Chooser\u0027 of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user\u0027s browser via the \u0027element\u0027 parameter, which is unsafely passed to the JavaScript \u0027eval\u0027 function. However, exploitation is limited to specific conditions where \u0027opener\u0027 is correctly set.",
  "published": "2024-12-19T14:15:06Z",
  "severity": "",
  "epss": 0.00495,
  "epssPercentile": 0.42743,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "phpldapadmin",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.2.6.7-4",
      "fix": "DEBIAN-CVE-2024-9101",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-9101",
      "released": "2024-12-19T14:15:06Z"
    },
    {
      "platform": "linux",
      "product": "phpldapadmin",
      "release": "Debian 14",
      "fixedVersion": "1.2.6.7-4",
      "fix": "DEBIAN-CVE-2024-9101",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-9101",
      "released": "2024-12-19T14:15:06Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}