CVE-2018-10228

2021-12-1419:15:07

Google

osv.dev

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.6%

JSON

Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web script or HTML via the changes_cp parameter to the index.php/admin/themes/sa/templatesavechanges URI.

CPENameOperatorVersion
limesurveyeq2.64.4+170330
limesurveyeq1.45a
limesurveyeq2.00_plus_121006
limesurveyeq2.00_plus_131122
limesurveyeq2.67.2+170728
limesurveyeq1.85_plus_2009-08-03
limesurveyeq1.91_plus_2011-06-01
limesurveyeq1.70_plus_2008-05-12
limesurveyeq2.50_plus_160425
limesurveyeq1.53_2007-11-01

Name	Operator	Version
limesurvey	eq	2.64.4+170330
limesurvey	eq	1.45a
limesurvey	eq	2.00_plus_121006
limesurvey	eq	2.00_plus_131122
limesurvey	eq	2.67.2+170728
limesurvey	eq	1.85_plus_2009-08-03
limesurvey	eq	1.91_plus_2011-06-01
limesurvey	eq	1.70_plus_2008-05-12
limesurvey	eq	2.50_plus_160425
limesurvey	eq	1.53_2007-11-01

Rows per page:

1-10 of 5171

References

limesurvey.com