LimeSurvey vulnerabilities
We track 20 vulnerabilities in LimeSurvey products across 2 products. 20 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.
Latest LimeSurvey vulnerabilities
- 7.1 High severity
LimeSurvey Community Edition: Improper Neutralization of Special Elements used in an SQL Command
LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participa
- 7.4 High severity
LimeSurvey Community Edition: Improper Neutralization of Input During Web Page Generation
LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participant_id containing
- 7.2 High severity
LimeSurvey: Improper Neutralization of Input During Web Page Generation
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the
- 7.1 High severity
LimeSurvey: Authorization Bypass Through User-Controlled Key
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the
- 7.4 High severity
LimeSurvey: Improper Neutralization of Input During Web Page Generation
LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.
- 7.4 High severity
LimeSurvey: Improper Neutralization of Input During Web Page Generation
LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.
- 7.4 High severity
LimeSurvey: Improper Neutralization of Input During Web Page Generation
LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute wit
- 7.2 High severity
LimeSurvey: Improper Neutralization of Input During Web Page Generation
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. Th
- 8.4 High severity
LimeSurvey: Improper Neutralization of Input During Web Page Generation
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-controlled
- 8.5 High severity
LimeSurvey: Improper Neutralization of Input During Web Page Generation
LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropria
- 7.7 High severity
LimeSurvey: Server-Side Request Forgery
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Atta
- 8.8 High severity
LimeSurvey: Improper Neutralization of Special Elements used in an SQL Command
The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which concatenates the values directly into a tid IN ('...') SQL clause without parameterization or input valida
- 8.8 High severity
LimeSurvey: Weak Password Recovery Mechanism for Forgotten Password
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::chec
- 7.5 High severity
LimeSurvey: Loop with Unreachable Exit Condition
Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS attack), by exhausting server or client resources. The system is unabl
- 7.5 High severity
LimeSurvey: Loop with Unreachable Exit Condition
Vulnerability in LimeSurvey 6.13.0 in the endpoint /optout that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS attack), by exhausting server or client resources. The system is unab
- 9.8 Critical severity
LimeSurvey: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability allows an attacker to retrieve, create, update and delete database via 'token' parameter in '/index.php' endpoint.
- 8.7 High severity
LimeSurvey: Improper Limitation of a Pathname to a Restricted Directory
An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validate serialized input to the admin backup endpoint (`index.php/admin/update/sa/backup`), allowing attack
- 8.8 High severity
limesurvey: Improper Control of Generation of Code
An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js_localize.php function
- 9.8 Critical severity
LimeSurvey: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in LimeSurvey 6.5.14-240624. Affected by this issue is the function actionUpdateSurveyLocaleSettingsGeneralSettings of the file /index.php?r=admin/database/index/updatesurveylocalesettings_generalsettings of the component Survey General S
- 8.8 High severity
limesurvey: Cross-Site Request Forgery
Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). The YII_CSRF_TOKEN is only checked when passed in the body of POST requests, but the same check isn't performed in the equivalent GET requests.