CVE-2025-31510

State: Published
Severity: 7.2 High
Published: Jan 16, 2026
Updated: Jan 16, 2026
Reserved: Mar 28, 2025

Description

In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) via the tab parameter, for Choice authentication.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N	mitre

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

Product	Versions
LemonLDAP::NGlemonldap-ng	2.0.8 to before 2.16.5Affected 2.17.0 to before 2.21.0Affected

References

https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3341
https://lists.debian.org/debian-lts-announce/2025/04/msg00017.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.