7.2
Élevée
CVE-2026-102626 An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a…
Description
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted inline JavaScript literal without JavaScript-context encoding.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| LimeSurvey | 7.4.0 | Pas de correctif indiqué |
Autres CVE de LimeSurvey
Les 27 CVE de LimeSurvey →
CVE-2026-97685
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an…
7.1
Élevée
CVE-2026-92730
LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative…
7.4
Élevée
CVE-2026-91775
LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file…
7.4
Élevée
CVE-2026-65931
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu…
5.1
Moyenne