CVE-2021-42112

CVE-2021-42112 affects LimeSurvey 3.x-LTS up to 3.27.18, where the File upload question feature enables cross-site scripting in assets/scripts/modaldialog.js and assets/scripts/uploader.js. The vulnerability is described across multiple feeds and CVSS scores indicate a likely medium severity (CVS...

CVE-2021-42112: Improper Neutralization of Input During Web Page Generation

The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js...

CVE-2018-16397: Unrestricted Upload of File with Dangerous Type

In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file,...