LimeSurvey is vulnerable to SQL injection

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2025-56421 · ADVISORY
• LimeSurvey/LimeSurvey#4328 · WEB
• LimeSurvey/LimeSurvey commit d6c3c78 · WEB
• LimeSurvey/LimeSurvey · PACKAGE
• hongancalif/security-advisories · WEB
• limesurvey.com · WEB

limesurvey/limesurvey のその他の脆弱性

• CVE-2026-50636高 8.8The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninv…
• CVE-2026-50635高 8.8LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHost…
• CVE-2024-28710中 6.1Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input …
• CVE-2024-28709中 6.1Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted scrip…
• CVE-2021-42112中 6.1The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/script…