CVE-2024-57279

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-07 · updated 2026-06-17
Weakness: CWE-79

Description

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the LDAP User Manager <= ce92321, specifically in the /setup/index.php endpoint via the returnto parameter. This vulnerability arises due to improper sanitization of user-supplied input, allowing an attacker to inject malicious JavaScript.

References

https://github.com/wheelybird/ldap-user-manager/issues/232
https://github.com/wheelybird/ldap-user-manager/issues/232

Get alerted when CVE-2024-57279 or the next vulnerability affects your stack