CVE-2020-35132

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via get_request in lib/function.php.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.launchpad.net/ubuntu/+source/phpldapadmin/+bug/1906474Issue Tracking, Third Party Advisory
https://github.com/leenooks/phpLDAPadmin/commit/c87571f6b7be15d5cd8b26381b6eb31ad03d28e2Patch, Third Party Advisory
https://github.com/leenooks/phpLDAPadmin/compare/1.2.5...1.2.6.2Patch, Third Party Advisory
https://github.com/leenooks/phpLDAPadmin/issues/130Exploit, Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XA42XDSUPCOXL5ZCP5RGD3FD4JQQWNX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6PZH3EY2T66N2MGOA7DWCAIVYIJH4BC/
https://bugs.launchpad.net/ubuntu/+source/phpldapadmin/+bug/1906474Issue Tracking, Third Party Advisory
https://github.com/leenooks/phpLDAPadmin/commit/c87571f6b7be15d5cd8b26381b6eb31ad03d28e2Patch, Third Party Advisory
https://github.com/leenooks/phpLDAPadmin/compare/1.2.5...1.2.6.2Patch, Third Party Advisory
https://github.com/leenooks/phpLDAPadmin/issues/130Exploit, Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XA42XDSUPCOXL5ZCP5RGD3FD4JQQWNX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6PZH3EY2T66N2MGOA7DWCAIVYIJH4BC/

Timeline

Published: Dec 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-351337.5irfanView 4.56 contains an error processing parsing files of type .pcx. Which leads to out-of-bounds writing at i_view32+0xdb60.CVE-2020-351358.8The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF.CVE-2020-351367.2Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the CVE-2020-351377.5The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the MobileIron SaaS disco CVE-2020-351389.8The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/CVE-2020-351397.5An issue was discovered in OFPBundleCtrlMsg in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of servic CVE-2020-35146.7A vulnerability in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker CVE-2020-351417.5An issue was discovered in OFPQueueGetConfigReply in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of CVE-2020-351457.8Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnerability in multiple co CVE-2020-351495.3lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., __proto__) can be copied during a merge or c CVE-2020-35156.1Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenti CVE-2020-351518.8The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injec