Medium severity · published Aug 14, 2026
CVE-2026-18403
LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB
6.0
CVSS
0.4%
EPSS
No
On KEV
Description
LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LimeSurvey · LimeSurvey
7.0.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18403
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18403
fluidattacks.com
https://fluidattacks.com/es/advisories/rihanna
github.com
https://github.com/LimeSurvey/LimeSurvey/
github.com
https://github.com/LimeSurvey/LimeSurvey/commit/7735ce31cea1cad087b0c8556cb65a1c09e29cbd
More from LimeSurvey
9.8
CVE-2025-56422
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server
9.8
CVE-2025-41375
SQL Injection in Limesurvey
9.8
CVE-2024-6933
A flaw has been found in LimeSurvey 6.5.14-240624
9.8
CVE-2022-48008
An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file
9.8
CVE-2019-25019
LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model