How severe is CVE-2018-12689?

CVE-2018-12689 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2018-12689 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (76th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-12689?

CVE-2018-12689 affects Phpldapadmin Project Phpldapadmin. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-12689?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2018-12689 published?

CVE-2018-12689 was published on 2018-06-22 and last updated on 2026-06-17.

CVE-2018-12689

CVE-2018-12689 is a critical-severity vulnerability in Phpldapadmin Project Phpldapadmin with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 2% (76th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Phpldapadmin Project Phpldapadmin
Published: 2018-06-22
Last modified: 2026-06-17

Description

phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a crafted username and password in the login panel.

Frequently asked questions

What is CVE-2018-12689?: phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a crafted username and password in the login panel.
How severe is CVE-2018-12689?: CVE-2018-12689 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2018-12689 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (76th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-12689?: CVE-2018-12689 affects Phpldapadmin Project Phpldapadmin. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-12689?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2018-12689 published?: CVE-2018-12689 was published on 2018-06-22 and last updated on 2026-06-17.

References

https://www.exploit-db.com/exploits/44926/

Affected products (1)

cpe:2.3:a:phpldapadmin_project:phpldapadmin:1.2.2:*:*:*:*:*:*:*

More vulnerabilities in Phpldapadmin Project Phpldapadmin

CVE-2011-4082 — High (CVSS 7.5): A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the…
CVE-2011-4075 — High (CVSS 7.5): The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute…
CVE-2009-4427 — High (CVSS 7.5): Directory traversal vulnerability in cmd.php in phpLDAPadmin 1.1.0.5 allows remote attackers to include and execute…
CVE-2005-2793 — High (CVSS 7.5): PHP remote file inclusion vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to…
CVE-2005-2654 — High (CVSS 7.5): phpldapadmin before 0.9.6c allows remote attackers to gain anonymous access to the LDAP server, even when…
CVE-2017-11107 — Medium (CVSS 6.1): phpLDAPadmin through 1.2.3 has XSS in htdocs/entry_chooser.php via the form, element, rdn, or container parameter.

All CVEs affecting Phpldapadmin Project Phpldapadmin →