CVE-2026-27895: Incorrect Regular Expression

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type including .php files can be uploaded. With...

CVE-2022-31084: Improper Neutralization of Argument Delimiters in a Command

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to cod...

CVE-2022-24851: Improper Neutralization of Input During Web Page Generation

LDAP Account Manager LAM is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS...

CVE-2012-1114: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists in LDAP Account Manager LAM Pro 3.6 in the filter parameter to cmd.php in an export and exporterid action. and the filteruid parameter to list.php...

CVE-2012-1115: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists in LDAP Account Manager LAM Pro 3.6 in the export, addvalueform, and dn parameters to cmd.php...