Skip to content

Limesurvey vulnerabilities

Products

Newest

limesurveyLimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups...CVE-2020-11456Public exploitFix availableEPSS 70.8%5.4 MediumApril 1, 2020
limesurveyLimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php...CVE-2019-145126.1 MediumMarch 16, 2020
limesurveyA cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in...CVE-2019-176606.1 MediumOctober 16, 2019
limesurveyAn XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote...CVE-2019-161748.8 HighSeptember 9, 2019
limesurveyA clickjacking vulnerability was found in Limesurvey before 3.17.14.CVE-2019-161754.3 MediumSeptember 9, 2019
limesurveyA path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote...CVE-2019-161765.3 MediumSeptember 9, 2019
limesurveyIn Limesurvey before 3.17.14, the entire database is exposed through browser caching.CVE-2019-161777.5 HighSeptember 9, 2019
limesurveyA stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that...CVE-2019-161785.4 MediumSeptember 9, 2019
limesurveyLimesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration.CVE-2019-161795.3 MediumSeptember 9, 2019
limesurveyLimesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate...CVE-2019-161805.3 MediumSeptember 9, 2019
limesurveyIn Limesurvey before 3.17.14, admin users can mark other users' notifications as read.CVE-2019-161812.7 LowSeptember 9, 2019
limesurveyA reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that...CVE-2019-161826.1 MediumSeptember 9, 2019
limesurveyIn Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions.CVE-2019-161832.7 LowSeptember 9, 2019
limesurveyA CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey...CVE-2019-161849.8 CriticalSeptember 9, 2019
limesurveyIn Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries...CVE-2019-161857.2 HighSeptember 9, 2019
limesurveyIn Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions.CVE-2019-161867.2 HighSeptember 9, 2019
limesurveyLimesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows...CVE-2019-161877.5 HighSeptember 9, 2019
limesurveyCross-site Scripting in LimeSurveyCVE-2019-16172Public exploitFix available5.4 MediumSeptember 9, 2019
limesurveyCross-site Scripting in LimeSurveyCVE-2019-16173Public exploitFix available5.4 MediumSeptember 9, 2019
limesurveyLimesurvey before 3.17.10 does not validate both the MIME type and file extension of an image.CVE-2019-156407.5 HighAugust 26, 2019
limesurveyThe downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1...CVE-2019-9960EPSS 13.4%9.8 CriticalMarch 24, 2019
limesurveyLimeSurvey before 2.72.4 has Stored XSS by using the Continue Later (aka Resume later) feature to...CVE-2017-183586.1 MediumJanuary 15, 2019
limesurveyLimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource...CVE-2018-203226.1 MediumDecember 21, 2018
limesurveyIn LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the...CVE-2018-170036.1 MediumSeptember 21, 2018
tecnick tcpdf, limesurvey +1 moreTCPDF vulnerable to attackers triggering deserialization of arbitrary dataCVE-2018-17057Public exploitFix availableEPSS 26.2%9.8 CriticalSeptember 14, 2018
limesurveyLimeSurvey version 3.14.4 and earlier contains a directory traversal in file upload that allows...CVE-2018-10006598.8 HighSeptember 6, 2018
limesurveyLimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality...CVE-2018-10006588.8 HighSeptember 6, 2018
limesurveyIn LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an...CVE-2018-163974.9 MediumSeptember 3, 2018
limesurveyLimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability...CVE-2018-10005144.3 MediumJune 26, 2018
limesurveyLimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in...CVE-2018-10005134.8 MediumJune 26, 2018
limesurvey, debian linux +1 moreLimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x before 3.4.2 mishandles application...CVE-2018-75569.1 CriticalFebruary 28, 2018
limesurveyLimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability...CVE-2018-10000538.8 HighFebruary 9, 2018
limesurveySQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php...CVE-2015-50786.5 MediumJune 28, 2015
limesurveySQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey...CVE-2015-46286.5 MediumJune 18, 2015
limesurveyIncomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey...CVE-2014-50184.3 MediumJuly 21, 2014
limesurveySQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in...CVE-2014-50177.5 HighJuly 21, 2014
limesurveyMultiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote...CVE-2014-50164.3 MediumJuly 21, 2014
limesurveyCross-site scripting (XSS) vulnerability in the tooltips in LimeSurvey before 1.91+ Build 11379...CVE-2011-52562.6 LowFebruary 12, 2013
limesurveyCross-site scripting (XSS) vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91...CVE-2012-49954.3 MediumSeptember 19, 2012
limesurveySQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows...CVE-2012-49946.5 MediumSeptember 19, 2012
limesurveySQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and...CVE-2012-4927Public exploit7.5 HighSeptember 15, 2012
limesurveyLimeSurvey 1.90+ build9642-20101214 allows remote attackers to obtain sensitive information via a...CVE-2011-37525.0 MediumSeptember 23, 2011
limesurveyUnspecified vulnerability in LimeSurvey before 1.82 allows remote attackers to execute commands...CVE-2009-16047.5 HighMay 11, 2009
limesurveyCross-site request forgery (CSRF) vulnerability in LimeSurvey (formerly PHPSurveyor) before 1.71...CVE-2008-25714.3 MediumJune 6, 2008
limesurveyMultiple unspecified vulnerabilities in LimeSurvey (formerly PHPSurveyor) before 1.71 have...CVE-2008-25709.3 HighJune 6, 2008
limesurveyPHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and...CVE-2007-5573Public exploit6.8 MediumOctober 18, 2007
limesurveyMultiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow...CVE-2007-3632Public exploitEPSS 61.5%6.8 MediumJuly 10, 2007