CVE Daily – LDAP Account Manager

CVE Daily – LDAP Account Manager https://cvedaily.com/pages/tags/ldap-account-manager.html CVE Daily – LDAP Account Manager en Wed, 03 Jun 2026 21:26:58 +0000 [Medium] CVE-2026-27895 – LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, gr... https://nvd.nist.gov/vuln/detail/CVE-2026-27895 https://nvd.nist.gov/vuln/detail/CVE-2026-27895 Wed, 18 Mar 2026 00:16:19 +0000 Medium CVE-2026-27895

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (including .php files) can be uploaded. With GHSA-w7xq-vjr3-p9cf, an attacker can achieve remote code execution as the web server user. Version 9…

CVSS: 4.3 · CWE: CWE-185

]]> [High] CVE-2026-27894 – LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, gr... https://nvd.nist.gov/vuln/detail/CVE-2026-27894 https://nvd.nist.gov/vuln/detail/CVE-2026-27894 Wed, 18 Mar 2026 00:16:19 +0000 High CVE-2026-27894

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to execute arbitrary code. Users need to login to LAM to exploit this…

CVSS: 8.8 · CWE: CWE-98

]]> [Medium] CVE-2025-58174 – LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LD... https://nvd.nist.gov/vuln/detail/CVE-2025-58174 https://nvd.nist.gov/vuln/detail/CVE-2025-58174 Tue, 16 Sep 2025 17:15:41 +0000 Medium CVE-2025-58174

LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile section via the profile name field, which renders untrusted input as HTML and executes a supplied script (for example a script element). An authenticated user with permission to create or edit a profile can insert a script payload into the…

CVSS: 4.6 · CWE: CWE-79

]]> [Medium] CVE-2024-52792 – LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users... https://nvd.nist.gov/vuln/detail/CVE-2024-52792 https://nvd.nist.gov/vuln/detail/CVE-2024-52792 Tue, 17 Dec 2024 22:15:07 +0000 Medium CVE-2024-52792

LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In affected versions LAM does not properly sanitize configuration values, that are set via `mainmanage.php` and `confmain.php`. This allows setting arbitrary config values and thus effectively bypassing `mitigation` of CVE-2024-23333/GHSA-fm9w-7m7v-wxqv. Configurat…

CVSS: 6.5 · CWE: CWE-610

]]> [High] CVE-2024-23333 – LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LD... https://nvd.nist.gov/vuln/detail/CVE-2024-23333 https://nvd.nist.gov/vuln/detail/CVE-2024-23333 Mon, 18 Mar 2024 21:15:06 +0000 High CVE-2024-23333

LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbitrary paths for log files. Prior to version 8.7, an attacker could exploit this by creating a PHP file and cause LAM to log some PHP code to this file. When the file is then accessed via web the code would be executed. The issue is mitigated by the following:…

CVSS: 7.9 · CWE: CWE-74

]]> [Medium] CVE-2022-31088 – LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, gr... https://nvd.nist.gov/vuln/detail/CVE-2022-31088 https://nvd.nist.gov/vuln/detail/CVE-2022-31088 Mon, 27 Jun 2022 21:15:08 +0000 Medium CVE-2022-31088

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.

CVSS: 5.3 · CWE: CWE-74

]]> [High] CVE-2022-31087 – LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, gr... https://nvd.nist.gov/vuln/detail/CVE-2022-31087 https://nvd.nist.gov/vuln/detail/CVE-2022-31087 Mon, 27 Jun 2022 21:15:08 +0000 High CVE-2022-31087

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (and .php5/.php4/.phpt/etc) files. An attacker capable of writing files under www-data privileges can write a web-shell into this directory, and gain a Code Exec…

CVSS: 7.8 · CWE: CWE-74

]]> [High] CVE-2022-31086 – LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, gr... https://nvd.nist.gov/vuln/detail/CVE-2022-31086 https://nvd.nist.gov/vuln/detail/CVE-2022-31086 Mon, 27 Jun 2022 21:15:08 +0000 High CVE-2022-31086

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configurat…

CVSS: 8.8 · CWE: CWE-74

]]> [Medium] CVE-2022-31085 – LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, gr... https://nvd.nist.gov/vuln/detail/CVE-2022-31085 https://nvd.nist.gov/vuln/detail/CVE-2022-31085 Mon, 27 Jun 2022 21:15:08 +0000 Medium CVE-2022-31085

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install t…

CVSS: 6.1 · CWE: CWE-311

]]> [High] CVE-2022-31084 – LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, gr... https://nvd.nist.gov/vuln/detail/CVE-2022-31084 https://nvd.nist.gov/vuln/detail/CVE-2022-31084 Mon, 27 Jun 2022 21:15:08 +0000 High CVE-2022-31084

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This iss…

CVSS: 8.1 · CWE: CWE-88

]]> [High] CVE-2022-24851 – LDAP Account Manager (LAM) is an open source web frontend for managing entries s... https://nvd.nist.gov/vuln/detail/CVE-2022-24851 https://nvd.nist.gov/vuln/detail/CVE-2022-24851 Fri, 15 Apr 2022 19:15:12 +0000 High CVE-2022-24851

LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS payloads in the profiles, which gets triggered when any other user try to access the edit profile page…

CVSS: 8.1 · CWE: CWE-22

]]> [Medium] CVE-2012-1115 – A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) ... https://nvd.nist.gov/vuln/detail/CVE-2012-1115 https://nvd.nist.gov/vuln/detail/CVE-2012-1115 Thu, 05 Dec 2019 21:15:11 +0000 Medium CVE-2012-1115

A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php.

CVSS: 6.1 · CWE: CWE-79

]]> [Medium] CVE-2012-1114 – A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) ... https://nvd.nist.gov/vuln/detail/CVE-2012-1114 https://nvd.nist.gov/vuln/detail/CVE-2012-1114 Thu, 05 Dec 2019 21:15:11 +0000 Medium CVE-2012-1114

A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action. and the filteruid parameter to list.php.

CVSS: 6.1 · CWE: CWE-79

]]> [High] CVE-2018-8764 – Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 places a CSRF ... https://nvd.nist.gov/vuln/detail/CVE-2018-8764 https://nvd.nist.gov/vuln/detail/CVE-2018-8764 Tue, 27 Mar 2018 16:29:00 +0000 High CVE-2018-8764

Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 places a CSRF token in the sec_token parameter of a URI, which makes it easier for remote attackers to defeat a CSRF protection mechanism by leveraging logging.

CVSS: 8.8 · CWE: CWE-352

]]> [Medium] CVE-2018-8763 – Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via th... https://nvd.nist.gov/vuln/detail/CVE-2018-8763 https://nvd.nist.gov/vuln/detail/CVE-2018-8763 Tue, 27 Mar 2018 16:29:00 +0000 Medium CVE-2018-8763

Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via the dn parameter to the templates/3rdParty/pla/htdocs/cmd.php URI or the template parameter to the templates/3rdParty/pla/htdocs/cmd.php?cmd=rename_form URI.

CVSS: 6.1 · CWE: CWE-79

]]> [Medium] CVE-2013-4453 – Cross-site scripting (XSS) vulnerability in templates/login.php in LDAP Account ... https://nvd.nist.gov/vuln/detail/CVE-2013-4453 https://nvd.nist.gov/vuln/detail/CVE-2013-4453 Tue, 05 Nov 2013 20:55:29 +0000 Medium CVE-2013-4453

Cross-site scripting (XSS) vulnerability in templates/login.php in LDAP Account Manager (LAM) 4.3 and 4.2.1 allows remote attackers to inject arbitrary web script or HTML via the language parameter.

CVSS: 4.3 · CWE: CWE-79

]]> [High] CVE-2006-7191 – Untrusted search path vulnerability in lamdaemon.pl in LDAP Account Manager (LAM... https://nvd.nist.gov/vuln/detail/CVE-2006-7191 https://nvd.nist.gov/vuln/detail/CVE-2006-7191 Tue, 03 Apr 2007 00:19:00 +0000 High CVE-2006-7191

Untrusted search path vulnerability in lamdaemon.pl in LDAP Account Manager (LAM) before 1.0.0 allows local users to gain privileges via a modified PATH that points to a malicious rm program.

CVSS: 7.2 · CWE: N/A

]]> [Medium] CVE-2007-1840 – lib/modules.inc in LDAP Account Manager (LAM) before 1.3.0 does not escape HTML ... https://nvd.nist.gov/vuln/detail/CVE-2007-1840 https://nvd.nist.gov/vuln/detail/CVE-2007-1840 Tue, 03 Apr 2007 00:19:00 +0000 Medium CVE-2007-1840

lib/modules.inc in LDAP Account Manager (LAM) before 1.3.0 does not escape HTML special characters in LDAP data, which allows remote attackers to have an unknown impact, probably cross-site scripting (XSS).

CVSS: 4.3 · CWE: N/A

]]>