CVSS: 2.6EPSS: 3%CPEs: 3EXPL: 13CVE-2006-2016 – phpLDAPadmin 0.9.8 - 'copy_form.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2006-2016
Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compare_form.php, (b) copy_form.php, (c) rename_form.php, (d) template_engine.php, and (e) delete_form.php; (2) scope parameter in (f) search.php; and (3) Container DN, (4) Machine Name, and (5) UID Number fields in (g) template_engine.php. • https://www.exploit-db.com/exploits/27718 https://www.exploit-db.com/exploits/27717 https://www.exploit-db.com/exploits/27719 https://www.exploit-db.com/exploits/27721 https://www.exploit-db.com/exploits/27722 http://pridels0.blogspot.com/2006/04/phpldapadmin-multiple-vuln.html http://secunia.com/advisories/19747 http://secunia.com/advisories/20124 http://www.debian.org/security/2006/dsa-1057 http://www.osvdb.org/24788 http://www.osvdb.org/24789 http://www&# • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 1%CPEs: 2EXPL: 2CVE-2005-2792 – phpLDAPadmin 0.9.6/0.9.7 - 'welcome.php' Arbitrary File Inclusion
https://notcve.org/view.php?id=CVE-2005-2792
Directory traversal vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the custom_welcome_page parameter. • https://www.exploit-db.com/exploits/26211 http://marc.info/?l=bugtraq&m=112542447219235&w=2 http://secunia.com/advisories/16617 http://www.rgod.altervista.org/phpldap.html http://www.securityfocus.com/bid/14695 https://exchange.xforce.ibmcloud.com/vulnerabilities/22103 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 2CVE-2005-2793
https://notcve.org/view.php?id=CVE-2005-2793
PHP remote file inclusion vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to execute arbitrary PHP code via the custom_welcome_page parameter. • http://marc.info/?l=bugtraq&m=112542447219235&w=2 http://secunia.com/advisories/16617 http://www.rgod.altervista.org/phpldap.html http://www.securityfocus.com/bid/14695 https://exchange.xforce.ibmcloud.com/vulnerabilities/22103 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2005-2654
https://notcve.org/view.php?id=CVE-2005-2654
phpldapadmin before 0.9.6c allows remote attackers to gain anonymous access to the LDAP server, even when disable_anon_bind is set, via an HTTP request to login.php with the anonymous_bind parameter set. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=322423 http://www.debian.org/security/2005/dsa-790 http://www.gentoo.org/security/en/glsa/glsa-200509-04.xml •