{"id":"CVE-2025-41376","aliases":["EUVD-2025-23353","GHSA-g37j-43j6-2q28"],"status":"published","title":"CRLF Injection in Limesurvey","description":"CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid/\u003cSID\u003e/token/fwyfw%0d%0aCookie:%20POC'.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00595,"percentile":0.48721,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89","CWE-93"],"published":"2025-08-01T12:29:59Z","modified":"2026-10-28T02:30:50Z","products":[{"vendor":"limesurvey","product":"limesurvey"},{"vendor":"tesi","product":"gandia integra total"}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-41376","tags":["advisory"]},{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi"},{"url":"https://github.com/advisories/GHSA-g37j-43j6-2q28"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/41xxx/CVE-2025-41376.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-41376","title":"CRLF Injection in Limesurvey","description":"CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid/\u003cSID\u003e/token/fwyfw%0d%0aCookie:%20POC'.","status":"published","published":"2025-08-01T12:29:59.023Z","modified":"2025-09-11T08:56:57.154Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:32:31.631102Z"}],"euvd":[{"id":"EUVD-2025-23353","description":"CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid/\u003cSID\u003e/token/fwyfw%0d%0aCookie:%20POC'.","status":"published","published":"2025-08-01T12:29:59Z","modified":"2025-09-11T08:56:57Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:31:45.093776Z"}],"ghsa":[{"id":"GHSA-g37j-43j6-2q28","title":"A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1...","description":"A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/consultacuotasred.php.","status":"published","published":"2025-08-01T15:34:18Z","modified":"2026-01-31T00:30:28Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-89","CWE-93"],"updated_at":"2026-11-02T15:05:59.660813Z"}],"nvd":[{"id":"CVE-2025-41376","description":"CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid/\u003cSID\u003e/token/fwyfw%0d%0aCookie:%20POC'.","status":"published","published":"2025-08-01T13:15:27.45Z","modified":"2026-06-17T09:22:47.617Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:11:21.71471Z"}],"osv":[{"id":"CVE-2025-41376","title":"CRLF Injection in Limesurvey","description":"CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid/\u003cSID\u003e/token/fwyfw%0d%0aCookie:%20POC'.","status":"published","published":"2025-08-01T12:29:59.023Z","modified":"2026-10-28T02:30:50.555612333Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:44:49.394967Z"}]}}