CVE-2025-63238: n/a
A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter in getInstance() function in application/models/QuestionCreate.php. This allows an attacker to craft a malicious URL and compromise the logged in user.
AI Analysis
Technical Summary
CVE-2025-63238 describes a reflected XSS vulnerability in LimeSurvey before version 6.15.11+250909. The vulnerability is due to lack of input validation on the 'gid' parameter in the getInstance() function of application/models/QuestionCreate.php. This flaw allows an attacker to inject malicious scripts via a crafted URL, potentially compromising authenticated users who access the URL. The CVE is published but lacks a CVSS score and official remediation details.
Potential Impact
Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a logged-in user's browser session, potentially leading to session hijacking or other client-side attacks. However, no known exploits have been reported in the wild, and the impact is limited to users who are authenticated and visit a maliciously crafted URL.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on untrusted links and consider applying any available updates from LimeSurvey promptly once released.
CVE-2025-63238: n/a
Description
A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter in getInstance() function in application/models/QuestionCreate.php. This allows an attacker to craft a malicious URL and compromise the logged in user.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-63238 describes a reflected XSS vulnerability in LimeSurvey before version 6.15.11+250909. The vulnerability is due to lack of input validation on the 'gid' parameter in the getInstance() function of application/models/QuestionCreate.php. This flaw allows an attacker to inject malicious scripts via a crafted URL, potentially compromising authenticated users who access the URL. The CVE is published but lacks a CVSS score and official remediation details.
Potential Impact
Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a logged-in user's browser session, potentially leading to session hijacking or other client-side attacks. However, no known exploits have been reported in the wild, and the impact is limited to users who are authenticated and visit a maliciously crafted URL.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on untrusted links and consider applying any available updates from LimeSurvey promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2025-10-27T00:00:00.000Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d843791cc7ad14da3fb68f
Added to database: 4/10/2026, 12:25:29 AM
Last enriched: 4/10/2026, 12:36:57 AM
Last updated: 4/10/2026, 7:59:57 AM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.