CVE-2007-3193
lib/WikiUser/LDAP.php in PhpWiki before 1.3.13p1, when the configuration lacks a nonzero...
CVE-2007-3193 is a high vulnerability (CVSS 10.0) in Phpwiki, published June 12, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.53%, the 89th percentile. Fixed in phpwiki 1.3.12p3-5etch1.
lib/WikiUser/LDAP.php in PhpWiki before 1.3.13p1, when the configuration lacks a nonzero PASSWORD_LENGTH_MINIMUM, might allow remote attackers to bypass authentication via an empty password, which causes ldap_bind to return true when used with certain LDAP implementations.
Exploit likelihood
What each source reports
NVD Score used
lib/WikiUser/LDAP.php in PhpWiki before 1.3.13p1, when the configuration lacks a nonzero PASSWORD_LENGTH_MINIMUM, might allow remote attackers to bypass authentication via an empty password, which causes ldap_bind to return true when used with certain LDAP implementations.
- Record
CVE-2007-3193- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
lib/WikiUser/LDAP.php in PhpWiki before 1.3.13p1, when the configuration lacks a nonzero PASSWORD_LENGTH_MINIMUM, might allow remote attackers to bypass authentication via an empty password, which causes ldap_bind to return true when used with certain LDAP implementations.
- Record
CVE-2007-3193- Updated
- 2026-11-02
EUVDEUVD-2007-3185 No score
lib/WikiUser/LDAP.php in PhpWiki before 1.3.13p1, when the configuration lacks a nonzero PASSWORD_LENGTH_MINIMUM, might allow remote attackers to bypass authentication via an empty password, which causes ldap_bind to return true when used with certain LDAP implementations.
- Record
EUVD-2007-3185- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qqr6-7wx3-g97v No score
lib/WikiUser/LDAP.php in PhpWiki before 1.3.13p1, when the configuration lacks a nonzero...
lib/WikiUser/LDAP.php in PhpWiki before 1.3.13p1, when the configuration lacks a nonzero PASSWORD_LENGTH_MINIMUM, might allow remote attackers to bypass authentication via an empty password, which causes ldap_bind to return true when used with certain LDAP implementations.
- Record
GHSA-qqr6-7wx3-g97v- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpwikiDebian:4.0 |
before 1.3.12p3-5etch1, plus listed versions 1.3.12p3-5 |
1.3.12p3-5etch1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, facts, references, title | GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |