7.4
High
CVE-2026-91775 LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file…
Description
LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| LimeSurvey | 7.0.14 | No fix stated |
Other CVEs of LimeSurvey
The 27 CVEs of LimeSurvey →
CVE-2026-102626
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a…
7.2
High
CVE-2026-97685
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an…
7.1
High
CVE-2026-92730
LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative…
7.4
High
CVE-2026-65931
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu…
5.1
Medium