CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
baseThe product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (114)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-9299US | critical9.8 | Exploit | ||
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP quer… | ||||
| CVE-2026-49268US | critical9.1 | Exploit | ||
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated… | ||||
| CVE-2021-43350US | critical9.8 | — | ||
An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized… | ||||
| CVE-2017-14596US | critical9.8 | — | ||
In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password. | ||||
| CVE-2021-41232US | critical9.8 | — | ||
Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances w… | ||||
| CVE-2018-12689US | critical9.8 | — | ||
phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a crafted username and password in the login panel. | ||||
| CVE-2011-4069US | critical9.8 | — | ||
html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted username. | ||||
| CVE-2015-6538US | critical9.8 | — | ||
The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, and consequently byp… | ||||
| CVE-2026-44930US | critical9.8 | — | ||
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.
U… | ||||
| CVE-2026-33289US | critical9.8 | — | ||
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP Injection vulnerability exists… | ||||
| CVE-2026-25560US | critical9.8 | — | ||
WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP search filters and DN-rel… | ||||
| CVE-2023-29050US | critical9.6 | — | ||
The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized… | ||||
| CVE-2023-6905US | critical9.8 | — | ||
A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5. This issue affects some unknown processing of the file user,adap.jsp?actionFlag=… | ||||
| CVE-2015-10027US | critical9.8 | — | ||
A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Hand… | ||||
| CVE-2017-8790US | critical9.8 | — | ||
An issue was discovered on Accellion FTA devices before FTA_9_12_180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injection. | ||||
| CVE-2026-39962US | critical9.6 | — | ||
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP… | ||||
| CVE-2025-67493US | critical9.0 | — | ||
Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to… | ||||
| CVE-2019-16212US | high8.8 | — | ||
A vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection. The vulnerability could allow a remote attacker t… | ||||
| CVE-2026-89071US | high8.8 | — | ||
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).
This issue affects MOVEit Transfer: b… | ||||
| CVE-2026-40459US | high8.8 | — | ||
PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan