Limesurvey-RCE

Limesurvey-RCE LimeSurvey Authenticated RCE Proof of Concept: 1. Create your files config.xml and php reverse shell files 2. Create archive with these files 3. Login with credentials 4. Go Configuration - Plugins - Upload & Install 5. Choose your zipped file 6. Upload 7. Install 8. Activate plugi...

CVE-2021-44967

CVE-2021-44967: LimeSurvey authenticated RCE Proof of concept for CVE-2021-44967. The script authenticates to LimeSurvey, uploads and activates a PHP plugin, and triggers a reverse shell. Use this only against systems you own or are authorized to test. Requirements Python 3 beautifulsoup4,...

CVE-2019-16172

CVE-2019-16172 The CVE-2019-16172 Scanner is designed to check LimeSurvey instances for the stored XSS vulnerability. CVE Descriptions CVE-2019-16172 Description: CVE-2019-16172 is a stored XSS vulnerability found in LimeSurvey versions prior to 3.17. The vulnerability arises due to improper...

CVE-2021-44967

CVE-2021-44967 Exploit Title: LimeSurvey 5.2.4 - Authenticated Remote Code Execution RCE Google Dork: inurl:limesurvey/index.php/admin/authentication/sa/login Date: 05/12/2021 Discovered by: Y1LD1R1M Exploit Author: D3Ext Vendor Homepage: https://www.limesurvey.org/ Software Link:...

CVE-2021-44967

CVE-2021-44967 - Authenticatedprivileged RCE Authenticated privileged remote command execution in LimeSurvey Version 5.2.4 via upload and install plugins allows a remote user to upload arbitrary PHP code file. Usage python3 exploit.py --url --user --password --lhost --lport A superadmin user is...

CVE-2026-116645

LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named...

CVE-2026-116645

LimeSurvey Community Edition 7.8.0 is vulnerable to an SQL injection vulnerability within the survey-archive participant import and SPSS-response export workflows. An authenticated user with the global surveys.create permission can exploit this by importing a specially crafted .lsa archive . This...

CVE-2026-116645

LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named...

CVE-2026-116645 LimeSurvey Community Edition 7.8.0 - SQL injection via Archive Attributes

LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named...

CVE-2026-116645 LimeSurvey Community Edition 7.8.0 - SQL injection via Archive Attributes

LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named...

EUVD-2026-123101

LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named...

CVE-2026-116645: LimeSurvey LimeSurvey Community Edition: LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and…

LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named...

PT-2026-144942

LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named...

CVE-2026-115640

LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participantid containing HTML. The import flow persists that...

CVE-2026-115640

LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participantid containing HTML. The import flow persists that...

CVE-2026-115640 LimeSurvey Community Edition 7.7.0 - Stored XSS in Central Participants blocklist control

LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participantid containing HTML. The import flow persists that...

EUVD-2026-120750

LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participantid containing HTML. The import flow persists that...

CVE-2026-115640 LimeSurvey Community Edition 7.7.0 - Stored XSS in Central Participants blocklist control

LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participantid containing HTML. The import flow persists that...

CVE-2026-115640

LimeSurvey Community Edition 7.7.0 is vulnerable to a stored cross-site scripting (XSS) vulnerability within the Central Participants Database blocklist control. An authenticated user possessing the global participantpanel:import permission can import a CSV file where the participant_id contains ...

CVE-2026-115640 LimeSurvey Community Edition 7.7.0 - Stored XSS in Central Participants blocklist control

LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participantid containing HTML. The import flow persists that...