Vulnerability · Published Aug 14, 2026 · Assigned by Fluid Attacks
CVE-2026-18403LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB
Medium 6.0
In plain English
A medium-severity SQL injection in LimeSurvey from LimeSurvey. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 4.0)6.0Medium
Exploit odds (30 days)0.4%top 68.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LimeSurvey | LimeSurvey | 7.0.5 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N