Advisories · Technology
LimeSurvey.
Every CVE that names LimeSurvey among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.2 High
LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 7.1 High
LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations
- LimeSurvey
- Broken access control
- CVSS 7.4 High
LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 7.4 High
LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint
- LimeSurvey
- Broken access control
- CVSS 7.4 High
LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 7.2 High
LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 8.4 High
LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 6.0 Medium
LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB
- LimeSurvey
- SQL injection
- CVSS 8.5 High
LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
LimeSurvey SSRF via REST API Survey Template Host Header
- LimeSurvey
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
LimeSurvey <= 4.3.10 - 'Survey Menu' Persistent Cross-Site Scripting
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Multiple vulnerabilities in Limesurvey
- LimeSurvey
- Information disclosure
- CVSS 6.9 Medium
Multiple vulnerabilities in Limesurvey
- LimeSurvey
- Denial of service
- CVSS 6.9 Medium
Multiple vulnerabilities in Limesurvey
- LimeSurvey
- Denial of service
- CVSS 5.1 Medium
CRLF Injection in Limesurvey
- LimeSurvey
- Other injection
- CVSS 9.3 CriticalCritical · CVSS 9+
SQL Injection in Limesurvey
- LimeSurvey
- SQL injection
- CVSS 8.7 High
LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup Payload
- LimeSurvey
- Path traversal
- Authentication bypass
- CVSS 5.1 Medium
LimeSurvey File Upload index.php denial of service
- LimeSurvey
- Denial of service
- CVSS 5.3 Medium
LimeSurvey Survey General Settings updatesurveylocalesettings_generalsettings actionUpdateSurveyLocaleSettingsGeneralSettings sql injection
- LimeSurvey
- Other injection
- SQL injection