Limesurvey
by Limesurvey
Source repositories
CVEs (88)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-16172 | Med | 0.31 | 5.4 | 0.05 | Sep 9, 2019 | LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion. | ||
| CVE-2018-1000513 | Med | 0.31 | 4.8 | 0.01 | Jun 26, 2018 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x. | ||
| CVE-2019-16180 | Med | 0.28 | 5.3 | 0.02 | Sep 9, 2019 | Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used. | ||
| CVE-2019-16179 | Med | 0.28 | 5.3 | 0.01 | Sep 9, 2019 | Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration. | ||
| CVE-2019-16178 | Med | 0.28 | 5.4 | 0.01 | Sep 9, 2019 | A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page. | ||
| CVE-2019-16176 | Med | 0.28 | 5.3 | 0.02 | Sep 9, 2019 | A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application in the filesystem. | ||
| CVE-2018-1000514 | Med | 0.28 | 4.3 | 0.00 | Jun 26, 2018 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to delete boxes. This vulnerability appears to have been fixed in 3.6.x. | ||
| CVE-2024-7887 | Low | 0.18 | 2.7 | 0.01 | Aug 17, 2024 | A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php of the component File Upload. The manipulation of the argument size leads to denial of service. The attack may be… | ||
| CVE-2020-11455 | Cri | 0.11 | 9.8 | 0.97 | Apr 1, 2020 | LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. | ||
| CVE-2019-16183 | Low | 0.11 | 2.7 | 0.01 | Sep 9, 2019 | In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions. | ||
| CVE-2019-16181 | Low | 0.11 | 2.7 | 0.01 | Sep 9, 2019 | In Limesurvey before 3.17.14, admin users can mark other users' notifications as read. | ||
| CVE-2020-11456 | Med | 0.09 | 5.4 | 0.71 | Apr 1, 2020 | LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups). | ||
| CVE-2007-3632 | 0.08 | — | 0.62 | Jul 10, 2007 | Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to execute arbitrary PHP code via a URL in the homedir parameter to (1) OLE/PPS/File.php, (2) OLE/PPS/Root.php, (3) Spreadsheet/Excel/Writer.php, or (4) OLE/PPS.php… | |||
| CVE-2019-9960 | Cri | 0.04 | 9.8 | 0.13 | Mar 24, 2019 | The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path. | ||
| CVE-2012-4927 | 0.03 | — | 0.02 | Sep 15, 2012 | SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php. | |||
| CVE-2007-5573 | 0.03 | — | 0.03 | Oct 18, 2007 | PHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter. | |||
| CVE-2026-63107 | Hig | 0.00 | 7.7 | 0.00 | Jul 20, 2026 | LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit… | ||
| CVE-2020-36993 | Med | 0.00 | 5.4 | 0.00 | Jan 28, 2026 | LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administration panel. Attackers can inject malicious SVG scripts through the Surveymenu[title] and Surveymenu[parent_id] parameters to execute arbitrary JavaScript in… | ||
| CVE-2024-42903 | Med | 0.00 | 6.5 | 0.01 | Sep 3, 2024 | A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain. | ||
| CVE-2024-42901 | Med | 0.00 | 4.8 | 0.00 | Sep 3, 2024 | A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file. |
- risk 0.31cvss 5.4epss 0.05
LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.
- risk 0.31cvss 4.8epss 0.01
LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x.
- risk 0.28cvss 5.3epss 0.02
Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used.
- risk 0.28cvss 5.3epss 0.01
Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration.
- risk 0.28cvss 5.4epss 0.01
A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page.
- risk 0.28cvss 5.3epss 0.02
A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application in the filesystem.
- risk 0.28cvss 4.3epss 0.00
LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to delete boxes. This vulnerability appears to have been fixed in 3.6.x.
- risk 0.18cvss 2.7epss 0.01
A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php of the component File Upload. The manipulation of the argument size leads to denial of service. The attack may be…
- risk 0.11cvss 9.8epss 0.97
LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.
- risk 0.11cvss 2.7epss 0.01
In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions.
- risk 0.11cvss 2.7epss 0.01
In Limesurvey before 3.17.14, admin users can mark other users' notifications as read.
- risk 0.09cvss 5.4epss 0.71
LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).
- CVE-2007-3632Jul 10, 2007risk 0.08cvss —epss 0.62
Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to execute arbitrary PHP code via a URL in the homedir parameter to (1) OLE/PPS/File.php, (2) OLE/PPS/Root.php, (3) Spreadsheet/Excel/Writer.php, or (4) OLE/PPS.php…
- risk 0.04cvss 9.8epss 0.13
The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.
- CVE-2012-4927Sep 15, 2012risk 0.03cvss —epss 0.02
SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php.
- CVE-2007-5573Oct 18, 2007risk 0.03cvss —epss 0.03
PHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter.
- risk 0.00cvss 7.7epss 0.00
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit…
- risk 0.00cvss 5.4epss 0.00
LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administration panel. Attackers can inject malicious SVG scripts through the Surveymenu[title] and Surveymenu[parent_id] parameters to execute arbitrary JavaScript in…
- risk 0.00cvss 6.5epss 0.01
A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain.
- risk 0.00cvss 4.8epss 0.00
A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file.
Page 3 of 5