CVE-2025-41376

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-41376
CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid/<SID>/token/fwyfw%0d%0aCookie:%20POC'.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*
History

30 Jan 2026, 21:44

Type Values Removed Values Added
References () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey - () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey - Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CPE cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*
First Time Limesurvey
Limesurvey limesurvey

11 Sep 2025, 09:15

Type Values Removed Values Added
Summary (en) A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/consultacuotasred.php. (en) CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid/<SID>/token/fwyfw%0d%0aCookie:%20POC'.
References
  • {'url': 'https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi', 'source': 'cve-coordination@incibe.es'}
  • () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey -
CWE CWE-89 CWE-93

04 Aug 2025, 15:06

Type Values Removed Values Added
Summary
  • (es) Se ha detectado una vulnerabilidad de inyección SQL en Gandia Integra Total of TESI, desde la versión 2.1.2217.3 hasta la v4.4.2236.1. Esta vulnerabilidad permite a un atacante autenticado recuperar, crear, actualizar y eliminar bases de datos mediante el parámetro 'idestudio' en /encuestas/integraweb[_v4]/integra/html/view/consultacuotasred.php.

01 Aug 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-01 13:15

Updated : 2026-01-30 21:44

NVD link : CVE-2025-41376

Mitre link : CVE-2025-41376

CVE.ORG link : CVE-2025-41376

JSON object : View

Products Affected

limesurvey

  • limesurvey
CWE
CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')