Limesurvey vulnerabilities

CVEs per yearBy the year they were published

1. 20255
2. 202615

Newest CVEs

• CVE-2026-102626

  LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute

  LimeSurvey · LimeSurvey

  High7.2
• CVE-2026-97685

  LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations

  LimeSurvey · LimeSurvey

  High7.1
• CVE-2026-92730

  LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name

  LimeSurvey · LimeSurvey

  High7.4
• CVE-2026-91775

  LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings

  LimeSurvey · LimeSurvey

  High7.4
• CVE-2026-65931

  LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint

  LimeSurvey · LimeSurvey

  Medium5.1
• CVE-2026-63360

  LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint

  LimeSurvey · LimeSurvey

  High7.4
• CVE-2026-16809

  LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering

  LimeSurvey · LimeSurvey

  High7.2
• CVE-2026-65930

  LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields

  LimeSurvey · LimeSurvey

  Medium4.8
• CVE-2026-15973

  LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries

  LimeSurvey · LimeSurvey

  High8.4
• CVE-2026-18403

  LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB

  LimeSurvey · LimeSurvey

  Medium6.0