CVE-2011-4075

CVE-2011-4075 affects phpLDAPadmin 1.2.x prior to 1.2.2, where the orderby parameter sent to query_engine via cmd.php allowed remote PHP code execution due to unsanitized input in the PHP create_function() call. The vulnerability enables unauthenticated remote code execution on the web server run...

CVE-2011-4082

CVE-2011-4082 affects phpLDAPadmin prior to 0.9.8. The issue is a local file inclusion flaw introduced by how the Accept-Language HTTP header is processed, allowing a remote attacker to cause a denial of service via a specially crafted request. Exploitation is described as network-based, with imp...

CVE-2005-2654

CVE-2005-2654 affects phpldapadmin prior to 0.9.6c, where an HTTP request to login.php with the anonymous_bind parameter can bypass disable_anon_bind and grant anonymous access to the LDAP server. Connected sources corroborate this flaw and link to affected releases and upstream advisories. Gento...

CVE-2009-4427

CVE-2009-4427: In phpLDAPadmin, phpLDAPadmin 1.1.0.5 is vulnerable to remote local-file inclusion via cmd.php (parameter cmd) due to insufficient input sanitising, enabling arbitrary local file execution. Debian and related advisories (DSA-1965) fix this by upgrading phpldapadmin to a later packa...

CVE-2005-2793

CVE-2005-2793 : phpLDAPadmin versions 0.9.6 and 0.9.7 contain a PHP remote file inclusion in welcome.php, exploitable via the custom_welcome_page parameter to execute arbitrary PHP code. The connected documents confirm the vulnerable component and the root cause (remote file inclusion) and vulner...