High severityNVD Advisory· Published Aug 26, 2026

CVE-2026-63360

Description

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding.

This issue affects LimeSurvey: 7.0.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Limesurvey/Limesurveyllm-fuzzy
Range: =7.0.5+260623

Patches

Vulnerability mechanics

References

fluidattacks.com/advisories/rainenvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000