EUVD-2026-91763
GHSA-wv52-h9cj-cvvw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv author (PR:L) and victim rendering (UI:R) are required; stored XSS runs in victim browser context (S:C) with limited confidentiality/integrity impact (C:L/I:L), no availability impact.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
2DescriptionCVE.org
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted inline JavaScript literal without JavaScript-context encoding.
AnalysisAI
Stored cross-site scripting in LimeSurvey Community Edition 7.4.0 lets an authenticated user holding the global "Surveys: create" permission inject a JavaScript-breaking value into the date_min (and, per the vendor patch, date_max) attribute of a Date/Time question, which is then executed in the browser of any other user who renders that question. The payload does not fire at storage time: exploitation is gated on a separate victim actively viewing the affected survey, which is why the assessed CVSS 4.0 vector (PR:L, UI:A, AT:P) requires both a privileged authoring account and victim interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated LimeSurvey account holding the global 'Surveys: create' permission (PR:L), the ability to author a Date/Time question type, and the 'date_min' (or, per the patch, 'date_max') attribute specifically - the payload must break out of a single-quoted inline JavaScript literal that LimeSurvey emits without JS-context encoding. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a stored (persistent) cross-site scripting flaw (CWE-79) in LimeSurvey Community Edition 7.4.0, confirmed by a vendor patch (commit 32e54f14) and source-code diff showing missing JavaScript-context encoding of the date_min/date_max attributes before insertion into single-quoted inline JS literals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status is "Upstream fix available (PR/commit); released patched version not independently confirmed" - upgrade to the first LimeSurvey release that incorporates commit 32e54f14f0b4ddc2d8144daaabf7e23c3bbfb8e8 and confirm the vendor changelog before relying on any specific build number, since no tagged patched version is established in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which LimeSurvey instances are running 7.4.0 and inventory every account holding the global 'Surveys: create' permission, then apply the vendor-released patch per the LimeSurvey security advisory and restart the application; where immediate patching is not possible, temporarily suspend or narrow survey-creation rights for lower-trust users and step up monitoring of survey authoring activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Limesurvey
View allLimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileM
The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relati
An issue was discovered in TCPDF before 6.2.22. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via
Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerabi
SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attack
SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 14
LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/th
Server-side request forgery in LimeSurvey through versions 6.17.10 and 7.0.4 exposes internal network infrastructure and
Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attacke
The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.
A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today