CWE-90 · LDAP Injection
70 CVEs classified under CWE-90 (LDAP Injection). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44930 | Critical | 9.8 | 2026-05-22 | An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates fr… |
CVE-2026-25560 | Critical | 9.8 | 2026-02-07 | WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP sear… |
CVE-2024-54852 | Critical | 9.8 | 2025-01-29 | When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper… |
CVE-2024-33868 | Critical | 9.8 | 2024-05-14 | An issue was discovered in linqi before 1.4.0.1 on Windows. There is LDAP injection. |
CVE-2021-43350 | Critical | 9.8 | 2021-11-11 | An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version… |
CVE-2011-4069 | Critical | 9.8 | 2018-02-01 | html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted… |
CVE-2017-14596 | Critical | 9.8 | 2017-09-20 | In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password. |
CVE-2017-8790 | Critical | 9.8 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injectio… |
CVE-2016-9299 | Critical | 9.8 | 2017-01-12 | The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which… |
CVE-2026-39962 | Critical | 9.6 | 2026-04-09 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthent… |
CVE-2026-49268 | Critical | 9.1 | 2026-06-17 | A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is d… |
CVE-2026-41919 | Critical | 9.1 | 2026-05-19 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24… |
CVE-2026-47303 | High | 8.8 | 2026-07-14 | Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
CVE-2026-13696 | High | 8.8 | 2026-07-07 | Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in HAVELSAN Inc. Liman MYS allows LDAP Injection. This issu… |
CVE-2026-40459 | High | 8.8 | 2026-04-17 | PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, pot… |
CVE-2026-33289 | High | 8.8 | 2026-03-20 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP Injection… |
CVE-2026-31828 | High | 8.8 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.13 and 8.6.26, the LDAP authentica… |
CVE-2025-48208 | High | 8.8 | 2025-09-09 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat . The attacker needs to have… |
CVE-2022-4254 | High | 8.8 | 2023-02-01 | sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters |
CVE-2026-4256 | High | 8.2 | 2026-07-09 | Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection. T… |