Threats affecting pkg:github/limesurvey/LimeSurvey

An authenticated user with the global Surveys: create permission in LimeSurvey Community Edition 7.4.0 can store a value in the date_min attribute of a Date/Time question that breaks JavaScript. This stored value is inserted into a single-quoted inline JavaScript literal without proper JavaScript-context encoding when the question is rendered by another user, leading to a potential cross-site scripting (XSS) vulnerability.

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the survey ID in the request URL, but the vulnerable persistence operations resolve the target object independently by its global qid or aid and never verify that it belongs to that authorized survey.

LimeSurvey Community Edition 7.0.14 has a reflected cross-site scripting (XSS) vulnerability on the administrative survey-participant CSV import result page. This vulnerability allows an attacker to inject malicious scripts that are reflected back to the administrator viewing the import results. The vulnerability is classified as high severity due to its potential impact on confidentiality and integrity. No patch or remediation information is currently provided.

LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting (XSS) vulnerability in the HTML editor popup endpoint. The vulnerability arises because the text and name query parameters are filtered by a blacklist sanitizer but then rendered without proper context-appropriate output encoding. This flaw allows an authenticated attacker to inject malicious scripts that could execute in the context of the affected application.

A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter in getInstance() function in application/models/QuestionCreate.php. This allows an attacker to craft a malicious URL and compromise the logged in user.

Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box[title] and box[url] parameters.

Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component.

An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js_localize.php function

A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file.

A flaw has been found in LimeSurvey 6.5.14-240624. Affected by this issue is the function actionUpdateSurveyLocaleSettingsGeneralSettings of the file /index.php?r=admin/database/index/updatesurveylocalesettings_generalsettings of the component Survey General Settings Handler. This manipulation of the argument Language causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 6.6.2+240827 can resolve this issue. Patch name: d656d2c7980b7642560977f4780e64533a68e13d. You should upgrade the affected component.