Ldap-Injection

A high-severity LDAP injection vulnerability, CVE-2026-4256, exists in PEAKUP Technology Inc.'s PassGate product through version 30042026, allowing an unauthenticated attacker to manipulate LDAP queries, potentially leading to high confidentiality impact and low integrity impact.

A high-severity LDAP injection vulnerability, tracked as CVE-2026-13696 with a CVSS v3.1 base score of 8.8, affects HAVELSAN Inc.'s Liman MYS versions prior to release.Master.1107, allowing attackers to bypass authentication or exfiltrate sensitive data via improper neutralization of special characters in LDAP queries.

CVE-2026-44930 is an LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF that may allow an attacker to retrieve arbitrary certificates from the repository.

ZITADEL's LDAP identity provider implementation fails to properly escape user-provided usernames before incorporating them into LDAP search filters, allowing unauthenticated attackers to perform LDAP Filter Injection to enumerate usernames and extract sensitive attribute data.

OPNsense versions prior to 26.1.6 are vulnerable to LDAP injection, allowing unauthenticated attackers to enumerate valid LDAP usernames and bypass group membership restrictions via the WebGUI login page.

Maddy Mail Server is vulnerable to LDAP injection via unsanitized username in the `auth.ldap` module, enabling identity spoofing, LDAP directory enumeration, and attribute value extraction by injecting arbitrary LDAP filter expressions through the username field in SMTP submission or IMAP LOGIN interfaces.