{"id":"CVE-2011-4074","aliases":["DEBIAN-CVE-2011-4074","DSA-2333-1","EUVD-2011-4026","GHSA-prjv-38qj-jwcv"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows...","description":"Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via an _debug command.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05386,"percentile":0.9272,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2011-10-31T00:00:00Z","modified":"2026-10-23T17:47:23Z","exploits":[{"source":"exploitdb","id":"EDB-18021","title":"phpLDAPadmin 1.2.1.1 - Remote PHP Code Injection (1)","type":"webapps","platform":"php","date":"2011-10-23","verified":true,"url":"https://www.exploit-db.com/exploits/18021"}],"fixes":[{"ecosystem":"Debian:12","package":"phpldapadmin","fixed_in":["1.2.0.5-2.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpldapadmin","fixed_in":["1.2.0.5-2.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpldapadmin","fixed_in":["1.2.0.5-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"phpldapadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0.5-2.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpldapadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0.5-2.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpldapadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0.5-2.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"phpldapadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0.5-2+squeeze1"}]}],"versions":["1.2.0.5-2"],"bundled":2},{"source":"osv","ecosystem":"Debian:5.0","package":"phpldapadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0.5-6+lenny2"}]}],"versions":["1.1.0.5-6","1.1.0.5-6+lenny1"],"bundled":2}],"products":[{"vendor":"phpldapadmin_project","product":"phpldapadmin"}],"references":[{"url":"http://www.securityfocus.com/bid/50331","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2011/10/25/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://secunia.com/advisories/46672","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/46551","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://openwall.com/lists/oss-security/2011/10/24/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://osvdb.org/76593","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://phpldapadmin.sourceforge.net/wiki/index.php/Main_Page","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2011/dsa-2333","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin%3Ba=blobdiff%3Bf=htdocs/cmd.php%3Bh=0ddf0044355abc94160be73122eb34f3e48ab2d9%3Bhp=34f3848fe4a6d4c00c7c568afa81f59579f5d724%3Bhb=64668e882b8866fae0fa1b25375d1a2f3b4672e2%3Bhpb=caeba72171ade4f588fef1818aa4f6243a68b85e","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4074"},{"url":"http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin;a=blobdiff;f=htdocs/cmd.php;h=0ddf0044355abc94160be73122eb34f3e48ab2d9;hp=34f3848fe4a6d4c00c7c568afa81f59579f5d724;hb=64668e882b8866fae0fa1b25375d1a2f3b4672e2;hpb=caeba72171ade4f588fef1818aa4f6243a68b85e"},{"url":"https://github.com/advisories/GHSA-prjv-38qj-jwcv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2011-4074","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-4074","description":"Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via an _debug command.","status":"published","published":"2011-11-02T17:00:00Z","modified":"2024-08-06T23:53:32.686Z","updated_at":"2026-11-02T14:35:37.989579Z"}],"euvd":[{"id":"EUVD-2011-4026","description":"Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via an _debug command.","status":"published","published":"2011-11-02T17:00:00Z","modified":"2024-08-06T23:53:32Z","updated_at":"2026-11-03T01:39:49.868954Z"}],"ghsa":[{"id":"GHSA-prjv-38qj-jwcv","title":"Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows...","description":"Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via an _debug command.","status":"published","published":"2022-05-13T01:13:45Z","modified":"2023-02-13T00:30:47Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:54:04.926808Z"}],"nvd":[{"id":"CVE-2011-4074","description":"Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via an _debug command.","status":"published","published":"2011-11-02T17:55:01.277Z","modified":"2026-06-16T23:34:22.687Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:10.769216Z"}],"osv":[{"id":"CVE-2011-4074","description":"Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via an _debug command.","status":"published","published":"2011-11-02T17:55:01Z","modified":"2026-04-10T03:42:00.694983Z","updated_at":"2026-11-02T15:43:58.279353Z"},{"id":"DEBIAN-CVE-2011-4074","description":"Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via an _debug command.","status":"published","published":"2011-11-02T17:55:01.277Z","modified":"2026-10-23T17:47:23.370649159Z","updated_at":"2026-11-02T15:45:24.612044Z"},{"id":"DSA-2333-1","title":"phpldapadmin - several issues","status":"published","published":"2011-10-31T00:00:00Z","modified":"2026-03-09T01:17:59.538511Z","updated_at":"2026-11-02T15:46:15.108335Z"}]}}