Medium severity · published Dec 31, 2020
CVE-2020-25799
LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Limesurvey · Limesurvey
3.21.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25799
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25799
Exploit
https://bugs.limesurvey.org/view.php?id=15681
Patch
https://github.com/LimeSurvey/LimeSurvey/commit/a5f317817da4577d9ff457fea9c96482b3d1df23
More from Limesurvey
9.8
CVE-2025-56422
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server
9.8
CVE-2025-41375
SQL Injection in Limesurvey
9.8
CVE-2024-6933
LimeSurvey Survey General Settings updatesurveylocalesettings_generalsettings actionUpdateSurveyLocaleSettingsGeneralSettings sql injection
9.8
CVE-2022-48008
An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file
9.8
CVE-2019-25019
LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model