Skip to main content

LimeSurvey EUVDEUVD-2026-58786

| CVE-2026-18403 MEDIUM
SQL Injection (CWE-89)
2026-08-14 Fluid Attacks GHSA-fxx2-xm5f-gmf5
SQLi Limesurvey
6.0
CVSS 4.0 · Vendor: Fluid Attacks
Share

Severity by source

Vendor (Fluid Attacks) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.9 MEDIUM

Authenticated access (PR:L) and active CPDB feature use required (AC:H); SQL injection in UPDATE context yields high confidentiality but limited integrity impact with no availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 14, 2026 - 19:21 vuln.today
Analysis Generated
Aug 14, 2026 - 19:21 vuln.today

DescriptionCVE.org

LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.

AnalysisAI

SQL injection in LimeSurvey Community Edition 7.0.5 exposes the Central Participant Database (CPDB) token-copy workflow to authenticated database exfiltration. An attacker with survey-level access can inject malicious SQL through unsanitized participantId, surveyId, tokenFieldname, and participantAttributeId parameters in Participant.php, achieving high-confidence read access to the underlying database with limited write impact. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain authenticated LimeSurvey credentials
Delivery
Access CPDB token-copy workflow
Exploit
Craft malicious participant ID or attribute field name
Execution
Inject SQL into UPDATE query context
Impact
Exfiltrate database contents via UNION or error-based technique
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated session in LimeSurvey with at least low-privilege participant management access - PR:L in the CVSS 4.0 vector confirms unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) yields a score of 6.0, reflecting network reachability, low authentication bar, and a specific attack requirement (AT:P) - the CPDB feature must be active and accessible to the attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated LimeSurvey user with survey participant management access triggers the CPDB token-copy workflow, injecting malicious SQL through the participant ID or token attribute field name parameter - for example, crafting a participant ID value containing a SQL UNION clause. The injected payload executes within the UPDATE query in `updateTokenAttributeValue()`, allowing UNION-based or error-based exfiltration of the full LimeSurvey database, including user credentials and survey response data. …
Remediation Apply the vendor-provided fix by updating to a LimeSurvey Community Edition version that incorporates commit 7735ce31cea1cad087b0c8556cb65a1c09e29cbd (https://github.com/LimeSurvey/LimeSurvey/commit/7735ce31cea1cad087b0c8556cb65a1c09e29cbd); note that a specific patched release version number is not confirmed from available data - verify remediation by inspecting `application/models/Participant.php` for the presence of parameterized queries and the `isValidTokenAttributeFieldname()` method. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Limesurvey

View all
CVE-2020-11455 CRITICAL POC
9.8 Apr 01

LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileM
CVE-2019-9960 CRITICAL POC
9.8 Mar 24

The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relati
CVE-2018-17057 CRITICAL POC
9.8 Sep 14

An issue was discovered in TCPDF before 6.2.22. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
CVE-2024-42902 HIGH POC
8.8 Sep 03

An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via

CVE-2024-39063 HIGH POC
8.8 Jul 09

Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerabi
CVE-2012-4927 HIGH POC
7.5 Sep 15

SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attack
CVE-2014-5017 HIGH POC
7.5 Jul 21

SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 14
CVE-2022-43279 HIGH POC
7.2 Nov 15

LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/th
CVE-2026-63107 MEDIUM POC
6.3 Jul 20

Server-side request forgery in LimeSurvey through versions 6.17.10 and 7.0.4 exposes internal network infrastructure and
CVE-2024-24506 MEDIUM POC
6.1 Apr 03

Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attacke
CVE-2021-42112 MEDIUM POC
6.1 Oct 08

The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.
CVE-2019-17660 MEDIUM POC
6.1 Oct 16

A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

EUVD-2026-58786 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy