By weakness (CWE)

CWE-90: related vulnerabilities

CVEs classified under CWE-90. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

2 published vulnerabilities

• CVE-2026-45559MEDIUM 4.9

  Roxy-WI, a web management interface for HAProxy, Nginx, Apache, and Keepalived servers, contains an LDAP injection vulnerability in its user authentication module. An administrator can manipulate the username parameter to break out of the intended LDAP search filter and enumerate or extract sensitive user attributes—such as email addresses—that should remain hidden. The vulnerability exists because user input is directly concatenated into the LDAP query without proper sanitization or escaping. While exploitation requires administrative privileges, the attack is straightforward once access is obtained, making it a credential harvesting risk in multi-tenant or federated identity environments.

• CVE-2026-42568MEDIUM 4.3

  Yamcs, a mission control framework used in aerospace and satellite operations, contains a flaw in how it validates user login attempts against LDAP directories. An authenticated user can inject specially crafted characters into their username to bypass normal search restrictions, potentially gaining unauthorized access to directory information. The vulnerability requires valid credentials to exploit, limiting immediate risk, but organizations relying on LDAP-backed Yamcs deployments should update promptly.