Stored Cross-Site Scripting in LDAP Account Manager by LDAP Account Manager

CVE-2025-58174

What is CVE-2025-58174?

LDAP Account Manager (LAM) presents a vulnerability that allows stored cross-site scripting in its Profile section. In versions prior to 9.3, an attacker with authenticated access can exploit this vulnerability by injecting a malicious script into the profile name field. When the profile data is viewed, the untrusted input is rendered as HTML, executing the injected script within the user's browser context. This opens the door for various attacks, including the theft of sensitive data or session hijacking. The issue is addressed in the updated version 9.3, which mitigates the risk associated with this vulnerability.

References