Cross-site Scripting in Limesurvey

Description

References

• nvd.nist.gov/vuln/detail/CVE-2021-42112 · ADVISORY
• LimeSurvey/LimeSurvey#2044 · WEB
• LimeSurvey/LimeSurvey commit d56619a · WEB
• bugs.limesurvey.org/view.php · WEB
• LimeSurvey/LimeSurvey · PACKAGE
• on-x.com/sites/default/files/on-x_-_security_advisory_-_limesurvey_-_cve-2021-42112.pdf · WEB

Autres vulnérabilités de limesurvey/limesurvey

• CVE-2026-50636ÉLEVÉE 8.8The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninv…
• CVE-2026-50635ÉLEVÉE 8.8LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHost…
• CVE-2025-56421ÉLEVÉE 7.5SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.
• CVE-2024-28710MOYENNE 6.1Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input …
• CVE-2024-28709MOYENNE 6.1Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted scrip…