LimeSurvey

Products

Exploited and recent CVEs

• CVE-2026-102626 High 7.2 LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute 0.3%
• CVE-2026-97685 High 7.1 LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations 0.3%
• CVE-2026-92730 High 7.4 LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name 0.5%
• CVE-2026-91775 High 7.4 LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings 0.5%
• CVE-2026-65931 Medium 5.1 LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint 0.4%
• CVE-2026-63360 High 7.4 LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint 0.5%
• CVE-2026-16809 High 7.2 LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering 0.4%
• CVE-2026-65930 Medium 4.8 LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields 0.4%
• CVE-2026-15973 High 8.4 LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries 0.4%
• CVE-2026-18403 Medium 6.0 LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB 0.4%
• CVE-2026-63361 High 8.5 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup 0.5%
• CVE-2026-63107 High 7.7 LimeSurvey SSRF via REST API Survey Template Host Header 0.4%
• CVE-2026-50636 High 8.8 LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection 0.4%
• CVE-2026-50635 High 8.8 LimeSurvey Password Reset Host Header Injection Discloses Reset Token 0.4%
• CVE-2020-36993 Medium 5.4 LimeSurvey <= 4.3.10 - 'Survey Menu' Persistent Cross-Site Scripting 0.3%
• CVE-2025-41076 Medium 6.9 Multiple vulnerabilities in Limesurvey 0.3%
• CVE-2025-41075 Medium 6.9 Multiple vulnerabilities in Limesurvey 0.3%
• CVE-2025-41074 Medium 6.9 Multiple vulnerabilities in Limesurvey 0.3%
• CVE-2025-41376 Medium 5.1 CRLF Injection in Limesurvey 0.6%
• CVE-2025-41375 Critical 9.3 SQL Injection in Limesurvey 0.7%