CWE-90 · Injection and Smuggling
Improper Neutralization of Special Elements used in an LDAP Query
108CVEs
0exploited
0with a public check
1likely (EPSS 10%+)
SortMost likely exploited
108 CVEs with CWE-90 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2016-9299The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP que…Jenkins · Jenkins · 2017-01-12 | – | 97% | 2017-01-12 |
| CVE-2017-14596In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.Joomla · Joomla! · 2017-09-20 | – | 6.9% | 2017-09-20 |
| CVE-2016-8750Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDA…Apache Software Foundation · Apache Karaf · 2018-02-19 | – | 5.2% | 2018-02-19 |
| CVE-2021-43350LDAP filter injection vulnerability in Traffic OpsApache Software Foundation · Apache Traffic Control · 2021-11-11 | – | 4.8% | 2021-11-11 |
| CVE-2017-4927VMware vCenter Server (6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c) does not correctly handle specially crafted LDAP network packets which may allow for remote denial of service.VMware · vCenter Server · 2017-11-17 | – | 2.3% | 2017-11-17 |
| CVE-2024-27310DOS VulnerabilityManageEngine · ADSelfService Plus · CVSS 5.3 · 2024-05-27 | 5.3 | 2.3% | 2024-05-27 |
| CVE-2018-5730MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "lin…Mit · Kerberos 5 · 2018-03-06 | – | 2.2% | 2018-03-06 |
| CVE-2015-7294ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.Ldapauth-Fork Project · Ldapauth-Fork · 2017-09-06 | – | 2.1% | 2017-09-06 |
| CVE-2019-11277Volume Services is vulnerable to an LDAP injection attackCloud Foundry · CF NFS volume release · CVSS 8.4 · 2019-09-23 | 8.4 | 1.7% | 2019-09-23 |
| CVE-2023-29050The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorize…Open-Xchange GmbH · OX App Suite · CVSS 7.6 · 2024-01-08 | 7.6 | 1.7% | 2024-01-08 |
| CVE-2022-45910Apache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory AuthoritiesApache Software Foundation · Apache ManifoldCF · CVSS 5.3 · 2022-12-07 | 5.3 | 1.6% | 2022-12-07 |
| CVE-2011-4069html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted username.Packetfence · Packetfence · 2018-02-01 | – | 1.6% | 2018-02-01 |
| CVE-2021-41276Indirect LDAP injection in TuleapEnalean · tuleap · CVSS 6.7 · 2021-12-15 | 6.7 | 1.5% | 2021-12-15 |
| CVE-2021-41232Improper Neutralization of Special Elements used in an LDAP QueryStevenWeathers · thunderdome-planning-poker · CVSS 8.1 · 2021-11-02 | 8.1 | 1.5% | 2021-11-02 |
| CVE-2021-43782Indirect LDAP injection in TuleapEnalean · tuleap · CVSS 6.7 · 2021-12-15 | 6.7 | 1.4% | 2021-12-15 |
| CVE-2017-8790An issue was discovered on Accellion FTA devices before FTA_9_12_180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injection.Accellion · File Transfer Appliance · 2017-05-05 | – | 1.4% | 2017-05-05 |
| CVE-2020-5281LDAP connector injection in PerunCESNET · perun · CVSS 6.2 · 2020-03-25 | 6.2 | 1.4% | 2020-03-25 |
| CVE-2023-28853Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP databasemastodon · mastodon · CVSS 7.7 · 2023-04-04 | 7.7 | 1.3% | 2023-04-04 |
| CVE-2021-32651LDAP injection via OneDev may leak some LDAP directory informationtheonedev · onedev · CVSS 3.1 · 2021-06-01 | 3.1 | 1.1% | 2021-06-01 |
| CVE-2019-4297IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attac…IBM · Robotic Process Automation with Automation Anywhere · CVSS 6.4 · 2019-07-01 | 6.4 | 1.0% | 2019-07-01 |
| CVE-2026-42568Yamcs Vulnerable to LDAP Injection in LdapAuthModuleyamcs · yamcs · CVSS 4.3 · 2026-06-10 | 4.3 | 1.0% | 2026-06-10 |
| CVE-2026-46619OpenAM Authentication Bypass via MSISDN LDAP InjectionOpenIdentityPlatform · OpenAM · CVSS 9.3 · 2026-09-15 | 9.3 | 1.0% | 2026-09-15 |
| CVE-2022-4254sssd: libsss_certmap fails to sanitise certificate data used in LDAP filtersFedoraproject · SSSD · CVSS 8.8 · 2023-02-01 | 8.8 | 1.0% | 2023-02-01 |
| CVE-2015-10027hydrian TTRSS-Auth-LDAP Username ldap injectionhydrian · TTRSS-Auth-LDAP · CVSS 5.5 · 2023-01-07 | 5.5 | 0.9% | 2023-01-07 |
| CVE-2026-1498WatchGuard Firebox LDAP InjectionWatchGuard · Fireware OS · CVSS 7 · 2026-01-30 | 7.0 | 0.9% | 2026-01-30 |
| CVE-2024-33868An issue was discovered in linqi before 1.4.0.1 on Windows. There is LDAP injection.Linqi · Linqi · CVSS 9.8 · 2024-05-14 | 9.8 | 0.9% | 2024-05-14 |
| CVE-2023-51446GLPI LDAP Injection during authenticationglpi-project · glpi · CVSS 5.9 · 2024-02-01 | 5.9 | 0.9% | 2024-02-01 |
| CVE-2020-5246LDAP injection vulnerability in Traccar GPS Tracking SystemTraccar · Traccar · CVSS 7.7 · 2020-07-14 | 7.7 | 0.9% | 2020-07-14 |
| CVE-2026-44617Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867Apache Software Foundation · Apache Zeppelin · CVSS 6.5 · 2026-07-30 | 6.5 | 0.8% | 2026-07-30 |
| CVE-2026-58222Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributesRed Hat · Red Hat Enterprise Linux 10 · CVSS 8.8 · 2026-07-30 | 8.8 | 0.8% | 2026-07-30 |
| CVE-2024-54852When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user…Sismics · Teedy · CVSS 9.8 · 2025-01-29 | 9.8 | 0.8% | 2025-01-29 |
| CVE-2025-52575EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elementsespocrm · espocrm · CVSS 6.5 · 2025-07-21 | 6.5 | 0.8% | 2025-07-21 |
| CVE-2026-44616Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter constructionApache Software Foundation · Apache Zeppelin · CVSS 6.5 · 2026-07-30 | 6.5 | 0.8% | 2026-07-30 |
| CVE-2026-25560WeKan < 8.19 LDAP Authentication Filter InjectionWeKan · WeKan · CVSS 8.7 · 2026-02-07 | 8.7 | 0.7% | 2026-02-07 |
| CVE-2026-44930Apache CXF: LDAP Injection vulnerability in XKMS LDAP RepositoryApache Software Foundation · Apache CXF · CVSS 4.3 · 2026-05-22 | 4.3 | 0.7% | 2026-05-22 |
| CVE-2026-33289SuiterCRM has LDAP Filter Injection in Authentication ModuleSuiteCRM · SuiteCRM · CVSS 8.8 · 2026-03-19 | 8.8 | 0.7% | 2026-03-19 |
| CVE-2025-48208Apache HertzBeat (incubating): Jmx JNDI injection vulnerabilityApache Software Foundation · Apache HertzBeat (incubating) · CVSS 8.8 · 2025-09-09 | 8.8 | 0.7% | 2025-09-09 |
| CVE-2023-6905Jahastech NxFilter Bind Request ldap injectionJahastech · NxFilter · CVSS 4.3 · 2023-12-17 | 4.3 | 0.7% | 2023-12-17 |
| CVE-2026-17392Multiple Vulnerabilities in IBM API ConnectIBM · API Connect · CVSS 9.9 · 2026-11-07 | 9.9 | 0.7% | 2026-11-07 |
| CVE-2026-40459LDAP Injection in PAC4JPAC4J · PAC4J · CVSS 8.7 · 2026-04-17 | 8.7 | 0.6% | 2026-04-17 |
| CVE-2026-109357LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Headerlibrenms · librenms · CVSS 8.1 · 2026-10-12 | 8.1 | 0.6% | 2026-10-12 |
| CVE-2026-46745Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/tokenApache Software Foundation · Apache Airflow FAB provider · CVSS 5.3 · 2026-05-25 | 5.3 | 0.6% | 2026-05-25 |
| CVE-2026-0636LDAP Injection Vulnerability in LDAPStoreHelper.javaLegion of the Bouncy Castle Inc. · BC-JAVA · CVSS 6.5 · 2026-04-15 | 6.5 | 0.5% | 2026-04-15 |
| CVE-2026-75020Apache APISIX: ldap-auth plugin cross-subtree identity impersonationApache Software Foundation · Apache APISIX · CVSS 7 · 2026-08-27 | 7.0 | 0.5% | 2026-08-27 |
| CVE-2026-15723Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLabGitLab · GitLab · CVSS 8.2 · 2026-10-21 | 8.2 | 0.5% | 2026-10-21 |
| CVE-2023-3447Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injectioncyberlord92 · Active Directory Integration / LDAP Integration · CVSS 7.6 · 2023-06-29 | 7.6 | 0.5% | 2023-06-29 |
| CVE-2026-11770389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status checkRed Hat · Red Hat Directory Server 11.5 E4S for RHEL 8 · CVSS 7.5 · 2026-07-31 | 7.5 | 0.5% | 2026-07-31 |
| CVE-2026-55770OpenBao: LDAPi ldaputil (wrong escape func)openbao · openbao · CVSS 6.8 · 2026-09-15 | 6.8 | 0.5% | 2026-09-15 |
| CVE-2026-89071MOVEit Transfer LDAP injection in certificate-based authenticationProgress · MOVEit Transfer · CVSS 7.5 · 2026-10-14 | 7.5 | 0.5% | 2026-10-14 |
| CVE-2026-13696LDAP Injection in HAVELSAN's Liman MYSHAVELSAN Inc. · Liman MYS · CVSS 8.8 · 2026-07-07 | 8.8 | 0.5% | 2026-07-07 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.