High severity · published Sep 9, 2019
CVE-2019-16174
An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data…
8.8
CVSS
2.4%
EPSS
No
On KEV
Description
An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Limesurvey · Limesurvey
before 3.17.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-16174
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-16174
Patch
https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R40
Release Notes
https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released
More from Limesurvey
9.8
CVE-2025-56422
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server
9.8
CVE-2025-41375
SQL Injection in Limesurvey
9.8
CVE-2024-6933
A flaw has been found in LimeSurvey 6.5.14-240624
9.8
CVE-2022-48008
An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file
9.8
CVE-2019-25019
LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model