Description
LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administration panel. Attackers can inject malicious SVG scripts through the Surveymenu[title] and Surveymenu[parent_id] parameters to execute arbitrary JavaScript in administrative contexts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Limesurvey | LimeSurvey | ≤ 4.3.10 | — |
References
- ExploitDB-48762 exploit
- LimeSurvey Official Website product
- LimeSurvey Patch Commit patch
- VulnCheck Advisory: LimeSurvey <= 4.3.10 - 'Survey Menu' Persistent Cross-Site Scripting third-party-advisory