Limesurvey vulnerabilities

Products

• Limesurvey 97

Newest

• limesurvey LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute CVE-2026-102626 7.2 HighOctober 2, 2026
• limesurvey LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations CVE-2026-97685 7.1 HighSeptember 29, 2026
• limesurvey LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name CVE-2026-92730 7.4 HighSeptember 23, 2026
• limesurvey LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings CVE-2026-91775 7.4 HighSeptember 23, 2026
• limesurvey LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint CVE-2026-65931 5.1 MediumAugust 27, 2026
• limesurvey LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint CVE-2026-63360 7.4 HighAugust 26, 2026
• limesurvey LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering CVE-2026-16809 7.2 HighAugust 26, 2026
• limesurvey LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields CVE-2026-65930 4.8 MediumAugust 26, 2026
• limesurvey LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries CVE-2026-15973 8.4 HighAugust 26, 2026
• limesurvey LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB CVE-2026-18403 6.0 MediumAugust 14, 2026
• limesurvey LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup CVE-2026-63361 8.5 HighAugust 14, 2026
• limesurvey LimeSurvey SSRF via REST API Survey Template Host Header CVE-2026-63107 6.3 MediumJuly 20, 2026
• limesurvey LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection CVE-2026-50636 8.7 HighJune 9, 2026
• limesurvey LimeSurvey Password Reset Host Header Injection Discloses Reset Token CVE-2026-50635 8.7 HighJune 9, 2026
• limesurvey Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to... CVE-2025-70797 6.1 MediumApril 9, 2026
• limesurvey A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due... CVE-2025-63238 6.1 MediumApril 9, 2026
• limesurvey A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to... CVE-2025-56422 9.8 CriticalMarch 10, 2026
• limesurvey LimeSurvey is vulnerable to SQL injection CVE-2025-56421 Fix available 7.5 HighMarch 10, 2026
• limesurvey LimeSurvey <= 4.3.10 - 'Survey Menu' Persistent Cross-Site Scripting CVE-2020-36993 5.1 MediumJanuary 28, 2026
• limesurvey Multiple vulnerabilities in Limesurvey CVE-2025-41076 Fix available 6.9 MediumNovember 20, 2025
• limesurvey Multiple vulnerabilities in Limesurvey CVE-2025-41075 Fix available 6.9 MediumNovember 20, 2025
• limesurvey Multiple vulnerabilities in Limesurvey CVE-2025-41074 Fix available 6.9 MediumNovember 20, 2025
• limesurvey, tesi gandia integra total +1 more CRLF Injection in Limesurvey CVE-2025-41376 5.1 MediumAugust 1, 2025
• limesurvey, tesi gandia integra total +1 more SQL Injection in Limesurvey CVE-2025-41375 9.3 CriticalAugust 1, 2025
• limesurvey LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup Payload CVE-2025-34120 8.7 HighJuly 16, 2025
• limesurvey LimeSurvey Cross Site Scripting vulnerability CVE-2024-28710 Fix available 6.1 MediumOctober 7, 2024
• limesurvey LimeSurvey Cross Site Scripting vulnerability CVE-2024-28709 Fix available 6.1 MediumOctober 7, 2024
• limesurvey A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806... CVE-2024-42903 Fix available 6.5 MediumSeptember 3, 2024
• limesurvey An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to... CVE-2024-42902 Fix available 8.8 HighSeptember 3, 2024
• limesurvey A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code... CVE-2024-42901 Fix available 4.8 MediumSeptember 3, 2024
• limesurvey LimeSurvey File Upload index.php denial of service CVE-2024-7887 5.1 MediumAugust 17, 2024
• limesurvey LimeSurvey Survey General Settings updatesurveylocalesettings_generalsettings actionUpdateSurveyLocaleSettingsGeneralSettings sql injection CVE-2024-6933 5.3 MediumJuly 21, 2024
• limesurvey Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). The YII_CSRF_TOKEN is... CVE-2024-39063 8.8 HighJuly 9, 2024
• limesurvey Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817... CVE-2024-24506 6.1 MediumApril 3, 2024
• limesurvey Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a... CVE-2023-44796 Fix available 5.4 MediumNovember 17, 2023
• limesurvey LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in... CVE-2022-48010 Fix availableDisputed 5.4 MediumJanuary 27, 2023
• limesurvey An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows... CVE-2022-48008 Fix available 9.8 CriticalJanuary 27, 2023
• limesurvey LimeSurvey v5.4.4 was discovered to contain a SQL injection vulnerability via the component ... CVE-2022-43279 Fix available 7.2 HighNovember 15, 2022
• limesurvey A cross-site scripting (XSS) vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below... CVE-2022-29710 Fix available 6.1 MediumMay 24, 2022
• limesurvey A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install... CVE-2021-44967 Public exploitFix availableDisputed EPSS 13.5% 8.8 HighFebruary 22, 2022
• limesurvey Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey... CVE-2018-10228 6.1 MediumDecember 14, 2021
• limesurvey Cross-site Scripting in Limesurvey CVE-2021-42112 Fix available 6.1 MediumOctober 8, 2021
• limesurvey Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2)... CVE-2020-22607 Fix available 6.1 MediumJune 28, 2021
• limesurvey Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications &... CVE-2020-23710 Fix available 5.4 MediumJune 28, 2021
• limesurvey LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model. CVE-2019-25019 9.8 CriticalFebruary 14, 2021
• limesurvey LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey... CVE-2020-25799 Fix available 5.4 MediumDecember 31, 2020
• limesurvey LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function ... CVE-2020-25797 Fix available 5.4 MediumDecember 31, 2020
• limesurvey A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1... CVE-2020-25798 Fix available 5.4 MediumNovember 17, 2020
• limesurvey LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks... CVE-2020-16192 Fix available 6.1 MediumAugust 5, 2020
• limesurvey LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application... CVE-2020-11455 Public exploitFix available EPSS 97.0% 9.8 CriticalApril 1, 2020
• Show olderLoading…