What is the CVSS score of CVE-2025-56421?

CVE-2025-56421 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Limesurvey are affected by CVE-2025-56421?

LimeSurvey installations are vulnerable to SQL injection attacks that could expose sensitive database information, including customer data, survey responses, and credentials.. A patch is available.

How to fix or mitigate CVE-2025-56421?

Within 24 hours: Identify all LimeSurvey instances in your environment and document their versions; isolate critical instances or restrict access to trusted networks only. Within 7 days: Implement WAF rules to block SQL injection patterns targeting LimeSurvey; monitor database access logs for suspicious queries. Within 30 days: Upgrade to LimeSurvey v.6.15.4+250710 or later when available; conduct database audit for unauthorized access indicators.

Limesurvey CVE-2025-56421

HIGH

SQL Injection (CWE-89)

2026-03-10 cve@mitre.org

GHSA-rccq-2fxq-7x3h

SQLi Limesurvey

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:17 nvd

HIGH 7.5

DescriptionCVE.org

SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.

AnalysisAI

SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database. [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects LimeSurvey. SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.