LDAPAccountManager vulnerabilities
We track 5 vulnerabilities in LDAPAccountManager products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on March 18, 2026.
Latest LDAPAccountManager vulnerabilities
- 8.8 High severity
lam: Incorrect Regular Expression
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type (inclu
- 8.8 High severity
lam: Improper Control of Filename for Include/Require Statement in PHP Program
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this
- 7.8 High severity
lam: Incorrect Authorization
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (and .php5/.php4/.phpt
- 8.8 High severity
lam: Unrestricted Upload of File with Dangerous Type
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability cou
- 8.1 High severity
lam: Improper Neutralization of Argument Delimiters in a Command
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first c