Vulnerabilities

TI-2026-22239 CVE-2026-27895

LAM has incorrect regular expression in PDF export component that allows user to upload files of any type

LOW 38

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00445 Published 2026-03-17 Fixed in 9.5 CWE-185

TI-2026-22238 CVE-2026-27894

LAM has Authenticated Local File Inclusion (LFI) in PDF export

MEDIUM 40

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00394 Published 2026-03-17 Fixed in 9.5 CWE-98

TI-2024-15435 CVE-2024-23333

LAM vulnerable to Authenticated Remote Code Execution

MEDIUM 52

LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory.

CVSS 3.1HIGH 7.9 Network High privileges No interaction EPSS 0.1775 Published 2024-03-18 Fixed in 8.7 CWE-74

TI-2022-13129 CVE-2022-31085

Missing Encryption of Sensitive Data in ldap-account-manager

LOW 27

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00272 Published 2022-06-27 Fixed in 8.0 CWE-311

TI-2022-13128 CVE-2022-31084

Unauthenticated Remote Code Execution in ldap-account-manager

HIGH 70

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.02485 Published 2022-06-27 Fixed in 8.0 CWE-88

TI-2022-13130 CVE-2022-31086

Incorrect Regular Expressions in ldap-account-manager

MEDIUM 44

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02287 Published 2022-06-27 Fixed in 8.0 CWE-74

TI-2022-13131 CVE-2022-31087

Incorrect Default Permissions in ldap-account-manager

LOW 36

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00439 Published 2022-06-27 Fixed in 8.0 CWE-74

TI-2022-13132 CVE-2022-31088

Unauthenticated LDAP Injection in ldap-account-manager

LOW 33

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01308 Published 2022-06-27 Fixed in 8.0 CWE-74

TI-2022-08663 CVE-2022-24851

Stored XSS and path traversal in LDAPAccountManager/lam

HIGH 70

LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory.

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.01113 Published 2022-04-15 Fixed in 7.9.1 CWE-22

TI-2012-01021 CVE-2012-1115 · GHSA-7jwm-cg5x-c66r

Cross-site scripting in LDAPAccountManager LDAP Account Manager Pro

LOW 30

A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01576 Published 2019-12-05 No fix listed CWE-79

TI-2012-01020 CVE-2012-1114 · GHSA-88f8-8wmr-26w2

Cross-site scripting in LDAPAccountManager LDAP Account Manager

LOW 30

A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01576 Published 2019-12-05 No fix listed CWE-79

TI-2018-06319 CVE-2018-8764 · GHSA-ff7w-m4j4-xp65

Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 places a CSRF token in…

MEDIUM 41

Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 places a CSRF token in the sec_token parameter of a URI, which makes it easier for remote attackers to defeat a CSRF protection mechanism by leveraging lo…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01271 Published 2018-03-27 No fix listed CWE-352

TI-2018-06318 CVE-2018-8763 · GHSA-pcvp-8j6c-wg38

Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via the dn…

LOW 30

Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via the dn parameter to the templates/3rdParty/pla/htdocs/cmd.php URI or the template parameter to the templates/3rdParty/pla/htdocs/cmd.php?cmd=r…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01497 Published 2018-03-27 No fix listed CWE-79

TI-2013-03904 CVE-2013-4453 · GHSA-5g8x-p6v8-2gx5

Cross-site scripting (XSS) vulnerability in templates/login.php in LDAP Account Manager…

LOW 23

Cross-site scripting (XSS) vulnerability in templates/login.php in LDAP Account Manager (LAM) 4.3 and 4.2.1 allows remote attackers to inject arbitrary web script or HTML via the language parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01355 Published 2013-11-05 No fix listed CWE-79

Vulnerabilities

Filters