Limesurvey vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-102626 An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribHigh 7.2 · Oct 2, 2026
• CVE-2026-97685 An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question orHigh 7.1 · Sep 28, 2026
• CVE-2026-92730 LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.High 7.4 · Sep 23, 2026
• CVE-2026-91775 LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resultinHigh 7.4 · Sep 23, 2026
• CVE-2026-63360 LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint.High 7.4 · Aug 26, 2026
• CVE-2026-16809 LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow.High 7.2 · Aug 26, 2026
• CVE-2026-15973 LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page.High 8.4 · Aug 26, 2026
• CVE-2026-63361 LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint.High 8.5 · Aug 14, 2026
• CVE-2026-50636 The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which concatHigh 8.7 · Jun 9, 2026
• CVE-2026-50635 LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.High 8.7 · Jun 9, 2026
• CVE-2025-56422 A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.Critical 9.8 · Mar 10, 2026
• CVE-2025-56421 SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.High 7.5 · Mar 10, 2026
• CVE-2025-41375 SQL Injection vulnerability in Limesurvey v2.65.1+170522.Critical 9.3 · Aug 1, 2025
• CVE-2025-34120 An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014.High 8.7 · Jul 16, 2025
• CVE-2024-42902 An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lngHigh 8.8 · Sep 3, 2024
• CVE-2024-39063 Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF).High 8.8 · Jul 9, 2024
• CVE-2022-48008 An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file.Critical 9.8 · Jan 27, 2023
• CVE-2022-43279 LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php.High 7.2 · Nov 15, 2022
• CVE-2021-44967 A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user uploaHigh 8.8 · Feb 24, 2022
• CVE-2019-25019 LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model.Critical 9.8 · Feb 13, 2021
• CVE-2020-11455 LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.Critical 9.8 · Apr 1, 2020
• CVE-2019-16187 Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script.High 7.5 · Sep 9, 2019
• CVE-2019-16186 In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions.High 7.2 · Sep 9, 2019
• CVE-2019-16185 In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.High 7.2 · Sep 9, 2019
• CVE-2019-16184 A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be Critical 9.8 · Sep 9, 2019