CVE-2025-31510
In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the logi...
Original description
The description as published by the source.
In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) via the tab parameter, for Choice authentication.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-31510 lemonldap-ng Fixed in: 2.0.11+ds-4+deb11u7
References
- advisory github.com
- advisory nvd.nist.gov
- report gitlab.ow2.org
- web lists.debian.org