VYPR
← All advisories
Medium severity4.6OSV Advisory· Published Sep 16, 2025· Updated Apr 15, 2026

CVE-2025-58174

CVE-2025-58174

Description

LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile section via the profile name field, which renders untrusted input as HTML and executes a supplied script (for example a script element). An authenticated user with permission to create or edit a profile can insert a script payload into the profile name and have it executed when the profile data is viewed in a browser. This issue is fixed in version 9.3. No known workarounds are mentioned.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Ldapaccountmanager/LamOSV2 versions
    8.5, 8.6, 8.6.RC1, …+ 1 more
    • (no CPE)range: 8.5, 8.6, 8.6.RC1, …
    • (no CPE)range: <9.3

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.