Filtered by vendor Limesurvey
Subscribe
Total
82 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-36993 | 1 Limesurvey | 1 Limesurvey | 2026-02-02 | N/A | 5.4 MEDIUM |
| LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administration panel. Attackers can inject malicious SVG scripts through the Surveymenu[title] and Surveymenu[parent_id] parameters to execute arbitrary JavaScript in administrative contexts. | |||||
| CVE-2025-41375 | 1 Limesurvey | 1 Limesurvey | 2026-01-30 | N/A | 9.8 CRITICAL |
| SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability allows an attacker to retrieve, create, update and delete database via 'token' parameter in '/index.php' endpoint. | |||||
| CVE-2025-41376 | 1 Limesurvey | 1 Limesurvey | 2026-01-30 | N/A | 5.3 MEDIUM |
| CRLF Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid/<SID>/token/fwyfw%0d%0aCookie:%20POC'. | |||||
| CVE-2024-24506 | 1 Limesurvey | 1 Limesurvey | 2026-01-30 | N/A | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrary code via the Administrator email address parameter in the General Setting function. | |||||
| CVE-2024-39063 | 1 Limesurvey | 1 Limesurvey | 2026-01-30 | N/A | 8.8 HIGH |
| Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). The YII_CSRF_TOKEN is only checked when passed in the body of POST requests, but the same check isn't performed in the equivalent GET requests. | |||||
| CVE-2024-7887 | 1 Limesurvey | 1 Limesurvey | 2026-01-30 | 3.3 LOW | 2.7 LOW |
| A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php of the component File Upload. The manipulation of the argument size leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-41074 | 1 Limesurvey | 1 Limesurvey | 2025-11-21 | N/A | 7.5 HIGH |
| Vulnerability in LimeSurvey 6.13.0 in the endpoint /optout that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability. | |||||
| CVE-2025-41075 | 1 Limesurvey | 1 Limesurvey | 2025-11-21 | N/A | 7.5 HIGH |
| Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability. | |||||
| CVE-2025-41076 | 1 Limesurvey | 1 Limesurvey | 2025-11-21 | N/A | 6.5 MEDIUM |
| In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the conflict. This information can simplify the collection of data about the internal architecture of the application by an attacker. | |||||
| CVE-2024-42901 | 1 Limesurvey | 1 Limesurvey | 2025-07-03 | N/A | 4.8 MEDIUM |
| A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file. | |||||
| CVE-2024-42902 | 1 Limesurvey | 1 Limesurvey | 2025-07-03 | N/A | 8.8 HIGH |
| An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js_localize.php function | |||||
| CVE-2022-48008 | 1 Limesurvey | 1 Limesurvey | 2025-03-28 | N/A | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file. | |||||
| CVE-2024-28710 | 1 Limesurvey | 1 Limesurvey | 2025-03-25 | N/A | 6.1 MEDIUM |
| Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component. | |||||
| CVE-2024-28709 | 1 Limesurvey | 1 Limesurvey | 2025-03-25 | N/A | 6.1 MEDIUM |
| Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and comment fields. | |||||
| CVE-2024-42903 | 1 Limesurvey | 1 Limesurvey | 2025-03-13 | N/A | 6.5 MEDIUM |
| A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain. | |||||
| CVE-2021-44967 | 1 Limesurvey | 1 Limesurvey | 2025-02-20 | 9.0 HIGH | 8.8 HIGH |
| A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be installed by a superadmin, and therefore the security model is not violated by this finding. | |||||
| CVE-2023-44796 | 1 Limesurvey | 1 Limesurvey | 2024-11-21 | N/A | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the _generaloptions_panel.php component. | |||||
| CVE-2022-48010 | 1 Limesurvey | 1 Limesurvey | 2024-11-21 | N/A | 5.4 MEDIUM |
| LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Welcome-message text fields. NOTE: the vendor indicates that this is not a vulnerability because the manipulation requires Superadministrator privileges, and Superadministrators are already allowed to customize surveys with JavaScript as they wish. | |||||
| CVE-2022-43279 | 1 Limesurvey | 1 Limesurvey | 2024-11-21 | N/A | 7.2 HIGH |
| LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php. | |||||
| CVE-2022-29710 | 1 Limesurvey | 1 Limesurvey | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a crafted plugin. | |||||