Vendor
LimeSurvey
23 known vulnerabilities.
14 results · Clear filters · Feed
-
High 7.1
LimeSurvey Community Edition 7.8.0 - SQL injection via Archive Attributes
LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose particip…
-
High 7.4
LimeSurvey Community Edition 7.7.0 - Stored XSS in Central Participants blocklist control
LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participant_id containin…
-
High 7.2
LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts th…
-
High 7.1
LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks th…
-
High 7.4
LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name
LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.
-
High 7.4
LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings
LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.
-
High 7.4
LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint
LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute wi…
-
High 7.2
LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. T…
-
High 8.4
LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-controlle…
-
High 8.5
LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup
LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropri…
-
High 7.7
LimeSurvey SSRF via REST API Survey Template Host Header
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Att…
-
High 8.8
LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection
The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which concatenates the values directly into a tid IN ('...') SQL clause without parameterization or input valid…
-
High 8.8
LimeSurvey Password Reset Host Header Injection Discloses Reset Token
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::che…
-
High 8.7CVE-2025-34120 Public exploit
LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup Payload
An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validate serialized input to the admin backup endpoint (`index.php/admin/update/sa/backup`), allowing attac…