CVE-2025-31510

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-16 · updated 2026-06-17
Weakness: CWE-79

Description

In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) via the tab parameter, for Choice authentication.

Affected products

lemonldap-ng LemonLDAP::NG: from 2.0.8 before 2.16.5; from 2.17.0 before 2.21.0 — fixed in 2.16.5, 2.21.0

How to fix

Upgrade to a fixed version: lemonldap-ng LemonLDAP::NG 2.16.5, 2.21.0. Check the vendor advisory for mitigations.

References

https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3341
https://lists.debian.org/debian-lts-announce/2025/04/msg00017.html

Get alerted when CVE-2025-31510 or the next vulnerability affects your stack