This vulnerability (CVE-2025-56421) affects LimeSurvey prior to version 6.15.4+250710 and involves SQL Injection (CWE-89). It enables a remote attacker to execute crafted SQL queries to extract sensitive database information. The CVSS v3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality only. There is no information about known exploits in the wild or vendor-provided patches.

An attacker can remotely exploit this SQL Injection vulnerability to obtain sensitive data from the LimeSurvey database. The integrity and availability of the system are not impacted according to the CVSS vector, but confidentiality is fully compromised. This could lead to unauthorized disclosure of sensitive survey data or user information stored in the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor LimeSurvey vendor communications for updates and apply any released patches promptly. Until a fix is available, consider restricting access to LimeSurvey interfaces and applying web application firewall rules to detect and block SQL Injection attempts.