RSS   Podatności dla 'Limesurvey'   RSS

2022-02-24
 
CVE-2021-44967

CWE-434
 
 
A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file.

 
2021-12-14
 
CVE-2018-10228

CWE-79
 
 
Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web script or HTML via the changes_cp parameter to the index.php/admin/themes/sa/templatesavechanges URI.

 
2021-06-28
 
CVE-2020-22607

CWE-79
 
 
Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/PermissiontemplatesController.php.

 
 
CVE-2020-23710

CWE-79
 
 
Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature.

 
2021-02-14
 
CVE-2019-25019

CWE-89
 
 
LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model.

 
2020-12-31
 
CVE-2020-25799

CWE-79
 
 
LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.

 
 
CVE-2020-25797

CWE-79
 
 
LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser.

 
2020-08-05
 
CVE-2020-16192

CWE-79
 
 
LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters.

 
2020-04-01
 
CVE-2020-11456

CWE-79
 
 
LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).

 
 
CVE-2020-11455

CWE-22
 
 
LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.

 

Copyright 2024, cxsecurity.com

 

Back to Top