EUVD-2026-58731
GHSA-r82m-pqrh-phxp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs no credentials to craft the link (PR:N) but victim must actively click it (UI:R); successful exploitation changes scope to the admin's browser session with full session compromise potential (S:C, C:H, I:H).
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding.
AnalysisAI
Reflected XSS in LimeSurvey Community Edition 7.0.5 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of an authenticated administrator by delivering a crafted URL targeting the HTML editor popup endpoint. The text and name query parameters bypass a blacklist-based sanitizer and are rendered unencoded across at least four distinct output contexts - an HTML title element, a JavaScript window.status assignment, and multiple document.getElementById() calls - confirmed by the patch commit diff. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim be a currently authenticated LimeSurvey administrator with access to the HTML editor popup endpoint - this is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.5 with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N reflects a high-severity, network-exploitable flaw requiring no attacker privileges but requiring victim interaction - consistent with a phishing-driven reflected XSS attack against an administrator account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a LimeSurvey 7.0.5 instance and crafts a URL targeting the admin HTML editor popup endpoint with a malicious `name` parameter that breaks out of the JavaScript string context in the `window.status` assignment - for example, injecting a payload that closes the string and appends an arbitrary script. The attacker delivers this URL to a logged-in LimeSurvey administrator via phishing email or a compromised forum link; when the admin opens the link, the payload executes in their browser session, enabling session cookie exfiltration or silently performing administrative actions such as adding a rogue admin account. … |
| Remediation | Apply the upstream fix available at commit a8993bfd05c4a11255b8400ed9c41a2c22e93aa4 in the LimeSurvey GitHub repository (https://github.com/LimeSurvey/LimeSurvey/commit/a8993bfd05c4a11255b8400ed9c41a2c22e93aa4), which replaces blacklist-based sanitization with context-appropriate encoding - CHtml::encode() for HTML contexts and CJavaScript::encode() for JavaScript string and identifier contexts - across all affected sinks in pop_editor_view.php. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all LimeSurvey Community Edition 7.0.5 instances and confirm patch availability from the vendor. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Limesurvey
View allLimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileM
The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relati
An issue was discovered in TCPDF before 6.2.22. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via
Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerabi
SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attack
SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 14
LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/th
Server-side request forgery in LimeSurvey through versions 6.17.10 and 7.0.4 exposes internal network infrastructure and
Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attacke
The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.
A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today