LI
Product
LimeSurvey
96
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 10High 27Medium 42Low 2
Watch
Add LimeSurvey to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-17660 | 6.1 | Oct 16 | A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier allows remote attackers to inject arbitrary web script or… Affected: through 3.19.1 |
| CVE-2019-16182 | 6.1 | Sep 9 | A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of… Affected: before 3.17.14 |
| CVE-2017-18358 | 6.1 | Jan 15 | LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later (aka Resume later) feature to enter an email address, which is mishandled in the admin panel Affected: before 2.72.4 |
| CVE-2018-20322 | 6.1 | Dec 21 | LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code execution against LimeSurvey… Affected: through 3.15.5 |
| CVE-2018-17003 | 6.1 | Sep 21 | In LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the surveyls_title parameter to /index.php?r=admin/survey/sa/insert Affected: 3.14.7 |
| CVE-2026-18403 | 6.0 | Aug 14 | LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB Affected: 7.0.5 |
| CVE-2020-36993 | 5.4 | Jan 28 | LimeSurvey <= 4.3.10 - 'Survey Menu' Persistent Cross-Site Scripting Affected: through 4.3.10 |
| CVE-2023-44796 | 5.4 | Nov 18 | Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the… Affected: before 6.2.9 |
| CVE-2022-48010 | 5.4 | Jan 27 | LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component… Affected: 5.4.15 |
| CVE-2020-23710 | 5.4 | Jun 28 | Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature Affected: 4.2.5 |
| CVE-2020-25799 | 5.4 | Dec 31 | LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page Affected: 3.21.1 |
| CVE-2020-25797 | 5.4 | Dec 31 | LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters) Affected: 3.21.1 |
| CVE-2020-25798 | 5.4 | Nov 17 | A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject arbitrary web script or… Affected: through 3.21.1 |
| CVE-2020-11456 | 5.4 | Apr 1 | LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups) Affected: through 4.1.11; 4.1.12; 4.1.12 |
| CVE-2019-16178 | 5.4 | Sep 9 | A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or… Affected: before 3.17.14 |
| CVE-2019-16173 | 5.4 | Sep 9 | LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin Affected: before 3.17.4 |
| CVE-2019-16172 | 5.4 | Sep 9 | LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin Affected: before 3.17.4 |
| CVE-2025-41376 | 5.3 | Aug 1 | CRLF Injection in Limesurvey Affected: 3.0 |
| CVE-2019-16180 | 5.3 | Sep 9 | Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used Affected: before 3.17.14 |
| CVE-2019-16179 | 5.3 | Sep 9 | Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration Affected: before 3.17.14 |
| CVE-2019-16176 | 5.3 | Sep 9 | A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application in the filesystem Affected: before 3.17.14 |
| CVE-2026-65931 | 5.1 | Aug 27 | LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint Affected: 7.0.5 |
| CVE-2024-7887 | 4.9 | Aug 17 | LimeSurvey File Upload index.php denial of service Affected: 6.3.0 |
| CVE-2018-16397 | 4.9 | Sep 3 | In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file, Affected: before 3.14.7 |
| CVE-2026-65930 | 4.8 | Aug 26 | LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields Affected: 7.0.5 |
| CVE-2024-42901 | 4.8 | Sep 3 | A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file Affected: through 6.5.12 |
| CVE-2018-1000513 | 4.8 | Jun 26 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution against LimeSurvey admins Affected: 3.0.0 |
| CVE-2019-16175 | 4.3 | Sep 9 | A clickjacking vulnerability was found in Limesurvey before 3.17.14 Affected: before 3.17.14 |
| CVE-2018-1000514 | 4.3 | Jun 26 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to delete boxes Affected: 3.0.0 |
| CVE-2019-16183 | 2.7 | Sep 9 | In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions Affected: before 3.17.14 |
| CVE-2019-16181 | 2.7 | Sep 9 | In Limesurvey before 3.17.14, admin users can mark other users' notifications as read Affected: before 3.17.14 |
| CVE-2015-5078 | – | Jun 28 | SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to execute arbitrary SQL… Affected: 2.06+ |
| CVE-2015-4628 | – | Jun 18 | SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authenticated administrators to execute… Affected: through 2.06\+ |
| CVE-2014-5018 | – | Jul 21 | Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS)… Affected: 2.05+ |
| CVE-2014-5017 | – | Jul 21 | SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute arbitrary SQL… Affected: 2.05+ |
| CVE-2014-5016 | – | Jul 21 | Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via (1) the pid attribute to the… Affected: 2.05+ |
| CVE-2011-5256 | – | Feb 12 | Cross-site scripting (XSS) vulnerability in the tooltips in LimeSurvey before 1.91+ Build 11379-20111116, when viewing survey results, allows remote attackers to inject arbitrary… Affected: through 1.91\+; 1.01; 1.50; 1.52; 1.53+; 1.70+; +9 more |
| CVE-2012-4995 | – | Sep 19 | Cross-site scripting (XSS) vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91+ Build 120224 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 1.91\+; 1.01; 1.50; 1.52; 1.53+; 1.70+; +9 more |
| CVE-2012-4994 | – | Sep 19 | SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in… Affected: through 1.91\+; 1.01; 1.50; 1.52; 1.53+; 1.70+; +9 more |
| CVE-2012-4927 | – | Sep 15 | SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames… Affected: through 1.90\+; 1.5.2; 1.49; 1.49; 1.49_rc2; 1.52; +6 more |
| CVE-2011-3752 | – | Sep 23 | LimeSurvey 1.90+ build9642-20101214 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error… Affected: 1.90+ |
| CVE-2009-1604 | – | May 11 | Unspecified vulnerability in LimeSurvey before 1.82 allows remote attackers to execute commands and obtain sensitive data via unknown attack vectors related to… Affected: 1.80; 1.80; 1.80+; 1.81; 1.81+ |
| CVE-2008-2571 | – | Jun 6 | Cross-site request forgery (CSRF) vulnerability in LimeSurvey (formerly PHPSurveyor) before 1.71 allows remote attackers to change arbitrary quotas as administrators via a "modify… Affected: through 1.70; 1.49; 1.52 |
| CVE-2008-2570 | – | Jun 6 | Multiple unspecified vulnerabilities in LimeSurvey (formerly PHPSurveyor) before 1.71 have unknown impact and attack vectors Affected: through 1.70 |
| CVE-2007-5573 | – | Oct 18 | PHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rootdir… Affected: through 1.5.2 |
| CVE-2007-3632 | – | Jul 10 | Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to execute arbitrary PHP code via a URL in the homedir parameter… Affected: 1.49_rc2 |