CVE-2024-36494

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin.cgi suffers from XSS due to improper input filtering of the -tsetup+-uuser parameter, which can only be exploited if th...

CVE-2024-36494

CVE-2024-36494 involves a cross-site scripting vulnerability on the login page (/cgi/slogin.cgi) caused by missing input sanitization of the -tsetup+-uuser parameter. The issue can allow an attacker to execute arbitrary JavaScript in other users’ browsers, potentially enabling phishing-focused lo...