Limesurvey
by Limesurvey
Source repositories
CVEs (93)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-16182 | Med | 0.33 | 6.1 | 0.01 | Sep 9, 2019 | A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of uploaded files. | ||
| CVE-2026-18403 | Med | 0.32 | — | 0.00 | Aug 14, 2026 | LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list. | ||
| CVE-2018-16397 | Med | 0.32 | 4.9 | 0.01 | Sep 3, 2018 | In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file, | ||
| CVE-2026-65930 | Med | 0.31 | — | 0.00 | Aug 26, 2026 | LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5. | ||
| CVE-2019-16173 | Med | 0.31 | 5.4 | 0.04 | Sep 9, 2019 | LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php, | ||
| CVE-2019-16172 | Med | 0.31 | 5.4 | 0.05 | Sep 9, 2019 | LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion. | ||
| CVE-2018-1000513 | Med | 0.31 | 4.8 | 0.01 | Jun 26, 2018 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x. | ||
| CVE-2019-16180 | Med | 0.28 | 5.3 | 0.02 | Sep 9, 2019 | Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used. | ||
| CVE-2019-16179 | Med | 0.28 | 5.3 | 0.01 | Sep 9, 2019 | Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration. | ||
| CVE-2019-16178 | Med | 0.28 | 5.4 | 0.01 | Sep 9, 2019 | A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page. | ||
| CVE-2019-16176 | Med | 0.28 | 5.3 | 0.02 | Sep 9, 2019 | A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application in the filesystem. | ||
| CVE-2018-1000514 | Med | 0.28 | 4.3 | 0.00 | Jun 26, 2018 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to delete boxes. This vulnerability appears to have been fixed in 3.6.x. | ||
| CVE-2024-7887 | Low | 0.18 | 2.7 | 0.01 | Aug 17, 2024 | A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php of the component File Upload. The manipulation of the argument size leads to denial of service. The attack may be… | ||
| CVE-2020-11455 | Cri | 0.11 | 9.8 | 0.97 | Apr 1, 2020 | LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. | ||
| CVE-2019-16183 | Low | 0.11 | 2.7 | 0.01 | Sep 9, 2019 | In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions. | ||
| CVE-2019-16181 | Low | 0.11 | 2.7 | 0.01 | Sep 9, 2019 | In Limesurvey before 3.17.14, admin users can mark other users' notifications as read. | ||
| CVE-2020-11456 | Med | 0.09 | 5.4 | 0.71 | Apr 1, 2020 | LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups). | ||
| CVE-2007-3632 | 0.08 | — | 0.62 | Jul 10, 2007 | Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to execute arbitrary PHP code via a URL in the homedir parameter to (1) OLE/PPS/File.php, (2) OLE/PPS/Root.php, (3) Spreadsheet/Excel/Writer.php, or (4) OLE/PPS.php… | |||
| CVE-2019-9960 | Cri | 0.04 | 9.8 | 0.12 | Mar 24, 2019 | The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path. | ||
| CVE-2012-4927 | 0.03 | — | 0.02 | Sep 15, 2012 | SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php. |
- risk 0.33cvss 6.1epss 0.01
A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of uploaded files.
- risk 0.32cvss —epss 0.00
LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.
- risk 0.32cvss 4.9epss 0.01
In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file,
- risk 0.31cvss —epss 0.00
LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5.
- risk 0.31cvss 5.4epss 0.04
LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php,
- risk 0.31cvss 5.4epss 0.05
LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.
- risk 0.31cvss 4.8epss 0.01
LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x.
- risk 0.28cvss 5.3epss 0.02
Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used.
- risk 0.28cvss 5.3epss 0.01
Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration.
- risk 0.28cvss 5.4epss 0.01
A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page.
- risk 0.28cvss 5.3epss 0.02
A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application in the filesystem.
- risk 0.28cvss 4.3epss 0.00
LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to delete boxes. This vulnerability appears to have been fixed in 3.6.x.
- risk 0.18cvss 2.7epss 0.01
A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php of the component File Upload. The manipulation of the argument size leads to denial of service. The attack may be…
- risk 0.11cvss 9.8epss 0.97
LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.
- risk 0.11cvss 2.7epss 0.01
In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions.
- risk 0.11cvss 2.7epss 0.01
In Limesurvey before 3.17.14, admin users can mark other users' notifications as read.
- risk 0.09cvss 5.4epss 0.71
LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).
- CVE-2007-3632Jul 10, 2007risk 0.08cvss —epss 0.62
Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to execute arbitrary PHP code via a URL in the homedir parameter to (1) OLE/PPS/File.php, (2) OLE/PPS/Root.php, (3) Spreadsheet/Excel/Writer.php, or (4) OLE/PPS.php…
- risk 0.04cvss 9.8epss 0.12
The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.
- CVE-2012-4927Sep 15, 2012risk 0.03cvss —epss 0.02
SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php.
Page 3 of 5