CVE-2024-36494 is a cross-site scripting (XSS) vulnerability in the login page at /cgi/slogin.cgi caused by missing input sanitization of the -tsetup+-uuser parameter. An attacker can exploit this flaw to run arbitrary JavaScript in the browser of users who are not already logged in, making it suitable for login form phishing attacks.