CVE-2026-18403 | | | 2026-08-14 | LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey… |
CVE-2026-63361 | | | 2026-08-14 | LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name… |
CVE-2026-63107 | High | 7.7 | 2026-07-20 | LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated us… |
CVE-2026-50636 | High | 8.8 | 2026-06-09 | The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which conca… |
CVE-2026-50635 | High | 8.8 | 2026-06-09 | LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that wo… |
CVE-2025-70797 | Medium | 6.1 | 2026-04-09 | Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box[title] and box[url] parameters. |
CVE-2025-63238 | Medium | 6.1 | 2026-04-09 | A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter in getInstance() fun… |
CVE-2025-56422 | Critical | 9.8 | 2026-03-10 | A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server. |
CVE-2025-56421 | High | 7.5 | 2026-03-10 | SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database. |
CVE-2020-36993 | Medium | 5.4 | 2026-01-28 | LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administration panel. Attackers can inject malic… |
CVE-2025-41076 | Medium | 6.5 | 2025-11-20 | In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a ge… |
CVE-2025-41075 | High | 7.5 | 2025-11-20 | Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generat… |
CVE-2025-41074 | High | 7.5 | 2025-11-20 | Vulnerability in LimeSurvey 6.13.0 in the endpoint /optout that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to gener… |
CVE-2025-41376 | Medium | 5.3 | 2025-08-01 | CRLF Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP… |
CVE-2025-41375 | Critical | 9.8 | 2025-08-01 | SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability allows an attacker to retrieve, create, update and delete database via 'token' par… |
CVE-2024-28710 | Medium | 6.1 | 2024-10-07 | Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and outp… |
CVE-2024-28709 | Medium | 6.1 | 2024-10-07 | Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and… |
CVE-2024-42903 | Medium | 6.5 | 2024-09-03 | A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password… |
CVE-2024-42902 | High | 8.8 | 2024-09-03 | An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the ln… |
CVE-2024-42901 | Medium | 4.8 | 2024-09-03 | A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file. |
CVE-2024-7887 | Low | 2.7 | 2024-08-17 | A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php… |
CVE-2024-6933 | Medium | 6.3 | 2024-07-21 | A flaw has been found in LimeSurvey 6.5.14-240624. Affected by this issue is the function actionUpdateSurveyLocaleSettingsGeneralSettings of the file /index.ph… |
CVE-2024-39063 | High | 8.8 | 2024-07-09 | Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). The YII_CSRF_TOKEN is only checked when passed in the body of POST requests, but the… |
CVE-2024-24506 | Medium | 6.1 | 2024-04-03 | Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrary code via the Ad… |
CVE-2023-44796 | Medium | 5.4 | 2023-11-18 | Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the… |
CVE-2022-48010 | Medium | 5.4 | 2023-01-27 | LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenul… |
CVE-2022-48008 | Critical | 9.8 | 2023-01-27 | An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-43279 | High | 7.2 | 2022-11-15 | LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php. |
CVE-2022-29710 | Medium | 6.1 | 2022-05-25 | A cross-site scripting (XSS) vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2021-44967 | High | 8.8 | 2022-02-24 | A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user uplo… |
CVE-2018-10228 | Medium | 6.1 | 2021-12-14 | Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web… |
CVE-2021-42112 | Medium | 6.1 | 2021-10-08 | The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js. |
CVE-2020-22607 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/Permissiontempla… |
CVE-2020-23710 | Medium | 5.4 | 2021-06-28 | Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature. |
CVE-2019-25019 | Critical | 9.8 | 2021-02-14 | LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model. |
CVE-2020-25799 | Medium | 5.4 | 2020-12-31 | LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administr… |
CVE-2020-25797 | Medium | 5.4 | 2020-12-31 | LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant bein… |
CVE-2020-25798 | Medium | 5.4 | 2020-11-17 | A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject arbit… |
CVE-2020-16192 | Medium | 6.1 | 2020-08-05 | LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters. |
CVE-2020-11456 | Medium | 5.4 | 2020-04-01 | LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey… |
CVE-2020-11455 | Critical | 9.8 | 2020-04-01 | LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. |
CVE-2019-14512 | Medium | 6.1 | 2020-03-16 | LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_… |
CVE-2019-17660 | Medium | 6.1 | 2019-10-16 | A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier allows remote attackers to inject arbit… |
CVE-2019-16187 | High | 7.5 | 2019-09-09 | Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script. |
CVE-2019-16186 | High | 7.2 | 2019-09-09 | In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions. |
CVE-2019-16185 | High | 7.2 | 2019-09-09 | In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions. |
CVE-2019-16184 | Critical | 9.8 | 2019-09-09 | A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be… |
CVE-2019-16183 | Low | 2.7 | 2019-09-09 | In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions. |
CVE-2019-16182 | Medium | 6.1 | 2019-09-09 | A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML… |
CVE-2019-16181 | Low | 2.7 | 2019-09-09 | In Limesurvey before 3.17.14, admin users can mark other users' notifications as read. |
CVE-2019-16180 | Medium | 5.3 | 2019-09-09 | Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used. |
CVE-2019-16179 | Medium | 5.3 | 2019-09-09 | Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration. |
CVE-2019-16178 | Medium | 5.4 | 2019-09-09 | A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arb… |
CVE-2019-16177 | High | 7.5 | 2019-09-09 | In Limesurvey before 3.17.14, the entire database is exposed through browser caching. |
CVE-2019-16176 | Medium | 5.3 | 2019-09-09 | A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application in the filesystem. |
CVE-2019-16175 | Medium | 4.3 | 2019-09-09 | A clickjacking vulnerability was found in Limesurvey before 3.17.14. |
CVE-2019-16174 | High | 8.8 | 2019-09-09 | An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or co… |
CVE-2019-16173 | Medium | 5.4 | 2019-09-09 | LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application… |
CVE-2019-16172 | Medium | 5.4 | 2019-09-09 | LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey grou… |
CVE-2019-15640 | High | 7.5 | 2019-08-26 | Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image. |
CVE-2019-9960 | Critical | 9.8 | 2019-03-24 | The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path. |
CVE-2017-18358 | Medium | 6.1 | 2019-01-15 | LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later (aka Resume later) feature to enter an email address, which is mishandled in the admin pane… |
CVE-2018-20322 | Medium | 6.1 | 2018-12-21 | LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code execution against Lim… |
CVE-2018-17003 | Medium | 6.1 | 2018-09-21 | In LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the surveyls_title parameter to /index.php?r=admin/survey/sa/inser… |
CVE-2018-17057 | Critical | 9.8 | 2018-09-14 | An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper. |
CVE-2018-1000659 | High | 8.8 | 2018-09-06 | LimeSurvey version 3.14.4 and earlier contains a directory traversal in file upload that allows upload of webshell vulnerability in file upload functionality t… |
CVE-2018-1000658 | High | 8.8 | 2018-09-06 | LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via websh… |
CVE-2018-16397 | Medium | 4.9 | 2018-09-03 | In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file, |
CVE-2018-1000514 | Medium | 4.3 | 2018-06-26 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to delete boxes. This v… |
CVE-2018-1000513 | Medium | 4.8 | 2018-06-26 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution against LimeSurvey admi… |
CVE-2018-7556 | Critical | 9.1 | 2018-02-28 | LimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x before 3.4.2 mishandles application/controller/InstallerController.php after installation, which a… |
CVE-2018-1000053 | High | 8.8 | 2018-02-09 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation that can result in CSRF causing LimeSur… |
CVE-2015-5078 | | | 2015-06-28 | SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to exec… |
CVE-2015-4628 | | | 2015-06-18 | SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authenticated administrat… |
CVE-2014-5018 | | | 2014-07-21 | Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-si… |
CVE-2014-5017 | | | 2014-07-21 | SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute… |
CVE-2014-5016 | | | 2014-07-21 | Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via (1) the… |
CVE-2011-5256 | | | 2013-02-12 | Cross-site scripting (XSS) vulnerability in the tooltips in LimeSurvey before 1.91+ Build 11379-20111116, when viewing survey results, allows remote attackers… |
CVE-2012-4995 | | | 2012-09-19 | Cross-site scripting (XSS) vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91+ Build 120224 allows remote attackers to inject arbitrary web… |
CVE-2012-4994 | | | 2012-09-19 | SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrary SQL commands via… |
CVE-2012-4927 | | | 2012-09-15 | SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands v… |
CVE-2011-3752 | | | 2011-09-23 | LimeSurvey 1.90+ build9642-20101214 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation… |
CVE-2009-1604 | | | 2009-05-11 | Unspecified vulnerability in LimeSurvey before 1.82 allows remote attackers to execute commands and obtain sensitive data via unknown attack vectors related to… |
CVE-2008-2571 | | | 2008-06-06 | Cross-site request forgery (CSRF) vulnerability in LimeSurvey (formerly PHPSurveyor) before 1.71 allows remote attackers to change arbitrary quotas as administ… |
CVE-2008-2570 | | | 2008-06-06 | Multiple unspecified vulnerabilities in LimeSurvey (formerly PHPSurveyor) before 1.71 have unknown impact and attack vectors. |
CVE-2007-5573 | | | 2007-10-18 | PHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and earlier allows remote attackers to execute arbitrary PHP code via… |
CVE-2007-3632 | | | 2007-07-10 | Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to execute arbitrary PHP code via a URL in th… |