7.2
High
CVE-2026-102626 An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a…
Description
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted inline JavaScript literal without JavaScript-context encoding.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| LimeSurvey | 7.4.0 | No fix stated |
Other CVEs of LimeSurvey
The 27 CVEs of LimeSurvey →
CVE-2026-97685
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an…
7.1
High
CVE-2026-92730
LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative…
7.4
High
CVE-2026-91775
LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file…
7.4
High
CVE-2026-65931
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu…
5.1
Medium