Login Request a demo
LI
Vendor
Limesurvey
1 product with CVEs on record
96
CVEs
0
On KEV
1
New 30D
Products
LI
LimeSurvey
Limesurvey
9.8
96 CVEs0 on KEV1 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-102626
LI
LimeSurvey
LimeSurvey
7.2
0%
Oct 2LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute
CVE-2026-97685
LI
LimeSurvey
LimeSurvey
7.1
0%
Sep 29LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations
CVE-2026-92730
LI
LimeSurvey
LimeSurvey
7.4
1%
Sep 23LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name
CVE-2026-91775
LI
LimeSurvey
LimeSurvey
7.4
1%
Sep 23LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings
CVE-2026-65931
LI
LimeSurvey
LimeSurvey
5.1
0%
Aug 27LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint
CVE-2026-63360
LI
LimeSurvey
LimeSurvey
7.4
0%
Aug 26LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint
CVE-2026-16809
LI
LimeSurvey
LimeSurvey
7.2
0%
Aug 26LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering
CVE-2026-65930
LI
LimeSurvey
LimeSurvey
4.8
0%
Aug 26LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields
CVE-2026-15973
LI
LimeSurvey
LimeSurvey
8.4
0%
Aug 26LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries
CVE-2026-18403
LI
LimeSurvey
LimeSurvey
6.0
0%
Aug 14LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB
CVE-2026-63361
LI
LimeSurvey
LimeSurvey
8.5
1%
Aug 14LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup
CVE-2026-63107
LI
LimeSurvey
LimeSurvey
7.7
0%
Jul 20LimeSurvey SSRF via REST API Survey Template Host Header
CVE-2026-50636
LI
LimeSurvey
LimeSurvey
8.8
0%
Jun 9LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection
CVE-2026-50635
LI
LimeSurvey
LimeSurvey
8.8
0%
Jun 9LimeSurvey Password Reset Host Header Injection Discloses Reset Token
CVE-2025-63238
LI
Limesurvey
Limesurvey
6.1
0%
Apr 9A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter in getInstance() function in…
CVE-2025-70797
LI
Limesurvey
Limesurvey
6.1
0%
Apr 9Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box[title] and box[url] parameters
CVE-2025-56421
LI
Limesurvey
Limesurvey
7.5
0%
Mar 10SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database
CVE-2025-56422
LI
Limesurvey
Limesurvey
9.8
1%
Mar 10A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server
CVE-2020-36993
LI
LimeSurvey
Limesurvey
5.4
0%
Jan 28LimeSurvey <= 4.3.10 - 'Survey Menu' Persistent Cross-Site Scripting
CVE-2025-41076
LI
LimeSurvey
LimeSurvey
6.5
0%
Nov 20Multiple vulnerabilities in Limesurvey
CVE-2025-41075
LI
LimeSurvey
LimeSurvey
7.5
0%
Nov 20Multiple vulnerabilities in Limesurvey
CVE-2025-41074
LI
LimeSurvey
LimeSurvey
7.5
0%
Nov 20Multiple vulnerabilities in Limesurvey
CVE-2025-41376
LI
LimeSurvey
LimeSurvey
5.3
1%
Aug 1CRLF Injection in Limesurvey
CVE-2025-41375
LI
LimeSurvey
LimeSurvey
9.8
1%
Aug 1SQL Injection in Limesurvey
CVE-2024-28710
LI
Limesurvey
Limesurvey
6.1
1%
Oct 7Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the…
CVE-2024-28709
LI
Limesurvey
Limesurvey
6.1
1%
Oct 7Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and comment fields
CVE-2024-42901
LI
Limesurvey
Limesurvey
4.8
0%
Sep 3A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file
CVE-2024-42903
LI
Limesurvey
Limesurvey
6.5
0%
Sep 3A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will…
CVE-2024-42902
LI
Limesurvey
Limesurvey
8.8
1%
Sep 3An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the…
CVE-2024-7887
LI
Limesurvey
Limesurvey
4.9
1%
Aug 17A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic
CVE-2024-6933
LI
Limesurvey
Limesurvey
9.8
1%
Jul 21A flaw has been found in LimeSurvey 6.5.14-240624
CVE-2024-39063
LI
Limesurvey
Limesurvey
8.8
0%
Jul 9Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF)
CVE-2024-24506
LI
Limesurvey
Limesurvey
6.1
1%
Apr 3Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrary code via the Administrator email…
CVE-2023-44796
LI
Limesurvey
Limesurvey
5.4
1%
Nov 18Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the…
CVE-2022-48010
LI
Limesurvey
Limesurvey
5.4
0%
Jan 27LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component…
CVE-2022-48008
LI
Limesurvey
Limesurvey
9.8
1%
Jan 27An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file
CVE-2022-43279
LI
Limesurvey
Limesurvey
7.2
1%
Nov 15LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php
CVE-2022-29710
LI
Limesurvey
Limesurvey
6.1
1%
May 25A cross-site scripting (XSS) vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a crafted plugin
CVE-2021-44967
LI
Limesurvey
Limesurvey
8.8
14%
Feb 24A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP…
CVE-2018-10228
LI
Limesurvey
Limesurvey
6.1
1%
Dec 14Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web script or HTML via…
CVE-2021-42112
LI
Limesurvey
Limesurvey
6.1
2%
Oct 8The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js
CVE-2020-22607
LI
Limesurvey
Limesurvey
6.1
1%
Jun 28Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/PermissiontemplatesController.php
CVE-2020-23710
LI
Limesurvey
Limesurvey
5.4
1%
Jun 28Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature
CVE-2019-25019
LI
Limesurvey
Limesurvey
9.8
1%
Feb 14LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model
CVE-2020-25799
LI
Limesurvey
Limesurvey
5.4
1%
Dec 31LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page
CVE-2020-25797
LI
Limesurvey
Limesurvey
5.4
1%
Dec 31LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters)
CVE-2020-25798
LI
Limesurvey
Limesurvey
5.4
1%
Nov 17A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject arbitrary web script or…
CVE-2020-16192
LI
Limesurvey
Limesurvey
6.1
1%
Aug 5LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters
CVE-2020-11456
LI
Limesurvey
Limesurvey
5.4
71%
Apr 1LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups)
CVE-2020-11455
LI
Limesurvey
Limesurvey
9.8
97%
Apr 1LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php
CVE-2019-14512
LI
Limesurvey
Limesurvey
6.1
1%
Mar 16LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php
CVE-2019-17660
LI
Limesurvey
Limesurvey
6.1
1%
Oct 16A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier allows remote attackers to inject arbitrary web script or…
CVE-2019-16187
LI
Limesurvey
Limesurvey
7.5
1%
Sep 9Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script
CVE-2019-16186
LI
Limesurvey
Limesurvey
7.2
1%
Sep 9In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions
CVE-2019-16185
LI
Limesurvey
Limesurvey
7.2
1%
Sep 9In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions
CVE-2019-16184
LI
Limesurvey
Limesurvey
9.8
2%
Sep 9A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the…
CVE-2019-16183
LI
Limesurvey
Limesurvey
2.7
1%
Sep 9In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions
CVE-2019-16182
LI
Limesurvey
Limesurvey
6.1
1%
Sep 9A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of…
CVE-2019-16181
LI
Limesurvey
Limesurvey
2.7
1%
Sep 9In Limesurvey before 3.17.14, admin users can mark other users' notifications as read
CVE-2019-16180
LI
Limesurvey
Limesurvey
5.3
2%
Sep 9Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used