Limesurvey CVE-2019-15640

HIGH

Improper Input Validation (CWE-20)

2019-08-26 cve@mitre.org

Information Disclosure Limesurvey

7.5

CVSS 3.0 · NVD

Share

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

1

CVE Published

Aug 26, 2019 - 17:15 nvd

HIGH 7.5

DescriptionNVD

Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image.

AnalysisAI

Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-20. Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image. Affected products include: Limesurvey. Version information: before 3.17.10.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Limesurvey

View all

CVE-2020-11455 CRITICAL Act Now POC

LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileM

CVE-2019-9960 CRITICAL Act Now POC

The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relati

CVE-2018-17057 CRITICAL Act Now POC

An issue was discovered in TCPDF before 6.2.22. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo

CVE-2024-42902 HIGH This Week POC

An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via

CVE-2024-39063 HIGH This Week POC

Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerabi

CVE-2012-4927 HIGH This Week POC

SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attack

CVE-2014-5017 HIGH This Week POC

SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 14

CVE-2022-43279 HIGH This Week POC

LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/th

CVE-2024-24506 MEDIUM This Month POC

Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attacke

CVE-2021-42112 MEDIUM This Month POC

The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.

CVE-2019-17660 MEDIUM This Month POC

A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier

CVE-2025-56422 CRITICAL Act Now

LimeSurvey before v6.15.0 has an insecure deserialization enabling remote code execution through crafted survey data.

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

CVE-2024-3400 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2023-22515 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2017-9791 CRITICAL POC

CVE-2017-15944 CRITICAL POC

CVE-2019-0604 CRITICAL POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2019-15640 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy