https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-48933.htmlhttps://patchthecve.com/cve/CVE-2024-48933.htmlWed, 17 Jun 2026 07:59:04 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page via a username if userControl has been set to a non-default value that allows special HTML characters.https://patchthecve.com/cve/CVE-2023-44469.htmlhttps://patchthecve.com/cve/CVE-2023-44469.htmlWed, 17 Jun 2026 06:27:41 +0000MEDIUM 4.3: A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770.https://patchthecve.com/cve/CVE-2019-19791.htmlhttps://patchthecve.com/cve/CVE-2019-19791.htmlWed, 17 Jun 2026 02:27:15 +0000CRITICAL 9.8: In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/REST endpoints (when some LemonLDAP::NG setup options are used). For example, an attacker can insert index.fcgi/index.fcgi into a URL to bypass a Require directivehttps://patchthecve.com/cve/CVE-2022-37186.htmlhttps://patchthecve.com/cve/CVE-2022-37186.htmlWed, 17 Jun 2026 04:54:43 +0000MEDIUM 5.9: In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically.https://patchthecve.com/cve/CVE-2023-28862.htmlhttps://patchthecve.com/cve/CVE-2023-28862.htmlWed, 17 Jun 2026 05:48:56 +0000CRITICAL 9.8: An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an AuthBasi