CVE-2025-31510

Description

In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) via the tab parameter, for Choice authentication.

Risk Information

Base Score

7.2

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.011

Associated Vulnerability

Vulnerability	OS Platform
lemonldap-ng security update(DSA-5897-1) lemonldap-ng_2.16.1+ds-deb12u6_all.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234