CVE-2020-5246

Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing specially crafted input, an attacker can modify the logic of the LDAP query and get admin privileges. The issue only impacts instances with LDAP configuration and where users can craft their own names. This has been patched in version 4.9.

• CWE-90
• CWE-74

• https://github.com/traccar/traccar/commit/e4f6e74e57ab743b65d49ae00f6624a20ca0291ePatch, Third Party Advisory
• https://github.com/traccar/traccar/security/advisories/GHSA-v955-7g22-2p49Third Party Advisory
• https://github.com/traccar/traccar/commit/e4f6e74e57ab743b65d49ae00f6624a20ca0291ePatch, Third Party Advisory
• https://github.com/traccar/traccar/security/advisories/GHSA-v955-7g22-2p49Third Party Advisory

Published

Jul 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5240In wagtail-2fa before 1.4.1, any user with access to the CMS…8.5
• CVE-2020-5241matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XS…5.4
• CVE-2020-5242openHAB before 2.5.2 allow a remote attacker to use REST cal…8.8
• CVE-2020-5243uap-core before 0.7.3 is vulnerable to a denial of service a…7.5
• CVE-2020-5244In BuddyPress before 5.1.2, requests to a certain REST API e…7.5
• CVE-2020-5245Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arb…8.8
• CVE-2020-5247In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an appl…7.5
• CVE-2020-5248GLPI before before version 9.4.6 has a vulnerability involvi…5.3
• CVE-2020-5249In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application…6.5
• CVE-2020-5250In PrestaShop before version 1.7.6.4, when a customer edits …6.3
• CVE-2020-5251In parser-server before version 4.1.0, you can fetch all the…5.3
• CVE-2020-5252The command-line "safety" package for Python has a potential…4.1