What is the CVSS score of CVE-2025-63238?

CVE-2025-63238 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2025-63238

EUVD-2025-209390 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-09 mitre

GHSA-5cw5-4v8j-xgrw

XSS PHP

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 17:45 euvd

EUVD-2025-209390

Analysis Generated

Apr 09, 2026 - 17:45 vuln.today

CVE Published

Apr 09, 2026 - 00:00 nvd

MEDIUM 6.1

DescriptionCVE.org

A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter in getInstance() function in application/models/QuestionCreate.php. This allows an attacker to craft a malicious URL and compromise the logged in user.

AnalysisAI

Reflected cross-site scripting in LimeSurvey prior to version 6.15.11+250909 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a malicious URL containing an unsanitized gid parameter passed to the getInstance() function in QuestionCreate.php. The vulnerability requires user interaction (clicking a crafted link) but affects logged-in users and can lead to session hijacking, credential theft, or malicious actions performed on behalf of the victim. No public exploitation has been confirmed at time of analysis, though proof-of-concept code is publicly available.

Technical ContextAI

LimeSurvey is a PHP-based survey application framework. The vulnerability stems from insufficient input validation in the getInstance() function within application/models/QuestionCreate.php, where the gid (group ID) parameter is reflected directly into the HTTP response without proper output encoding or sanitization. This is a classic reflected XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where untrusted user input is rendered in HTML context without escaping. The attack vector is network-based with low complexity; the application accepts the parameter without validation and returns it in the response, allowing an attacker to inject malicious script payloads that execute in the victim's browser with their session privileges.

RemediationAI

Upgrade LimeSurvey to version 6.15.11+250909 or later. The upstream fix is available in GitHub commit 80769a677dc82ddb1fcced4af19bd959d583208d, which implements proper input validation and output encoding for the gid parameter in the getInstance() function. Organizations unable to upgrade immediately should implement a web application firewall (WAF) rule to block requests containing suspicious characters in the gid parameter (such as script tags, quotes, or encoded payload variants) or restrict access to LimeSurvey administrative and survey creation interfaces to trusted networks. The NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2025-63238 provides additional remediation guidance.