LDAPAccountManager vulnerabilities

Products

• lam 12

Latest LDAPAccountManager CVEs

Newest publication first

1. CVE-2026-55167 LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session

   Published 2026-10-14

   Medium·CVSS 4.2 EPSS 0.21%

   LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is p...

2. CVE-2026-27895 LAM has incorrect regular expression in PDF export component that allows user to upload files of any type

   Published 2026-03-17

   High·CVSS 8.8 EPSS 0.49%

   LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (including .php files) can...

3. CVE-2026-27894 LAM has Authenticated Local File Inclusion (LFI) in PDF export

   Published 2026-03-17

   High·CVSS 8.8 EPSS 0.44%

   LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In...

4. CVE-2025-58174 LAM profile editor stored cross-site scripting vulnerability

   Published 2025-09-16

   Medium·CVSS 4.6 EPSS 0.18%

   LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile section via the profile name field, which renders untrusted input as HTML and executes a supplied script (for example a s...

5. CVE-2024-52792 Arbitrary config values override in lam

   Published 2024-12-17

   Medium·CVSS 6.5 EPSS 0.71%

   LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In affected versions LAM does not properly sanitize configuration values, that are set via mainmanage.php and confmain.php. This allows setting ar...

6. CVE-2024-23333 LAM vulnerable to Authenticated Remote Code Execution

   Published 2024-03-18

   Medium·CVSS 6.6 EPSS 17.8%

   LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbitrary paths for log files. Prior to version 8.7, an attacker could exploit this by creating a PHP file and cause LAM to log some PHP code to...

7. CVE-2022-31085 Missing Encryption of Sensitive Data in ldap-account-manager

   Published 2022-06-27

   Medium·CVSS 6.1 EPSS 0.27%

   LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encr...

8. CVE-2022-31084 Unauthenticated Remote Code Execution in ldap-account-manager

   Published 2022-06-27

   High·CVSS 8.1 EPSS 2.5%

   LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument....

9. CVE-2022-31086 Incorrect Regular Expressions in ldap-account-manager

   Published 2022-06-27

   High·CVSS 8.8 EPSS 2.3%

   LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote...

10. CVE-2022-31087 Incorrect Default Permissions in ldap-account-manager

    Published 2022-06-27

    High·CVSS 7.8 EPSS 0.44%

    LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (and .php5/.php4/.phpt/etc) files. An atta...

11. CVE-2022-31088 Unauthenticated LDAP Injection in ldap-account-manager

    Published 2022-06-27

    Medium·CVSS 5.3 EPSS 1.3%

    LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This...

12. CVE-2022-24851 Stored XSS and path traversal in LDAPAccountManager/lam

    Published 2022-04-15

    Medium·CVSS 4.8 EPSS 1.1%

    LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated us...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.