https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-35132.htmlhttps://patchthecve.com/cve/CVE-2020-35132.htmlWed, 17 Jun 2026 03:13:25 +0000MEDIUM 5.4: An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via get_request in lib/function.php.https://patchthecve.com/cve/CVE-2011-4082.htmlhttps://patchthecve.com/cve/CVE-2011-4082.htmlTue, 16 Jun 2026 23:34:23 +0000HIGH 7.5: A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-Language" HTTP header. A remote attacker could use this flaw to cause a denial of service via specially-crafted request.https://patchthecve.com/cve/CVE-2018-12689.htmlhttps://patchthecve.com/cve/CVE-2018-12689.htmlWed, 17 Jun 2026 01:38:10 +0000CRITICAL 9.8: phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a crafted username and password in the login panel.https://patchthecve.com/cve/CVE-2017-11107.htmlhttps://patchthecve.com/cve/CVE-2017-11107.htmlWed, 17 Jun 2026 01:01:13 +0000MEDIUM 6.1: phpLDAPadmin through 1.2.3 has XSS in htdocs/entry_chooser.php via the form, element, rdn, or container parameter.https://patchthecve.com/cve/CVE-2012-0834.htmlhttps://patchthecve.com/cve/CVE-2012-0834.htmlTue, 16 Jun 2026 23:38:21 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a query_engine action to cmd.php.https://patchthecve.com/cve/CVE-2011-4075.htmlhttps://patchthecve.com/cve/CVE-2011-4075.htmlTue, 16 Jun 2026 23:34:22 +0000HIGH 7.5: The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.https://patchthecve.com/cve/CVE-2011-4074.htmlhttps://patchthecve.com/cve/CVE-2011-4074.htmlTue, 16 Jun 2026 23:34:22 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via an _debug command.