CVE-2021-44967

CVE-2021-44967 - 인증된권한 있는 RCE LimeSurvey 버전 5.2.4의 플러그인 업로드 및 설치를 통한 인증된권한 있는 원격 명령 실행으로, 원격 사용자가 임의의 PHP 코드 파일을 업로드할 수 있습니다. 사용법 python3 exploit.py --url --user --password --lhost --lport 슈퍼관리자 사용자는 LimeSurvey 관리 패널을 통해 플러그인 모듈을 로드할 수 있습니다. 스크립트는 로컬에서 파일을 생성하고 압축한 다음 업로드합니다. 그 후 모듈을 설치, 활성화 및 실행...

CVE-2019-16172

CVE-2019-16172 CVE-2019-16172 扫描器旨在检查 LimeSurvey 实例是否存在存储型 XSS 漏洞。 CVE 描述 CVE-2019-16172 描述：CVE-2019-16172 是 LimeSurvey 3.17 之前版本中存在的一个存储型 XSS 漏洞。该漏洞是由于在创建调查组时对用户输入的验证不当所致。攻击者可通过提交特制的有效载荷来利用此漏洞，该有效载荷可存储在服务器上，并在其他用户访问调查时在其上下文中执行。 影响：成功利用此漏洞可使攻击者在应用程序上下文中执行任意 JavaScript，从而导致潜在的数据泄露、会话劫持及其他恶意活动。 扫描器...

Limesurvey-RCE

Limesurvey-RCE LimeSurvey 認証済み RCE 概念実証: 1. ファイル config.xml と php リバースシェルファイル を作成 2. これらのファイルでアーカイブを作成 3. 認証情報でログイン 4. 設定 - プラグイン - アップロードとインストール へ移動 5. ZIPファイルを選択 6. アップロード 7. インストール 8. プラグインを有効化 9. リスナーを起動 10. url+upload/plugins/Name/Shellfilename にアクセス 11. リバースシェルを取得 :shipit: 自動化された悪用には...

CVE-2021-44967

CVE-2021-44967: Удаленное выполнение кода RCE в LimeSurvey Описание Данный PoC Proof-of-Concept может быть использован для эксплуатации уязвимости CVE-2021-44967 с целью загрузки и выполнения вредоносного PHP-плагина LimeSurvey с правами администратора для получения обратной оболочки reverse shel...

LimeSurvey 4.1.11 - Local File Inclusion

LimeSurvey before 4.1.12+200324 is vulnerable to local file inclusion because it contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. id: CVE-2020-11455 info: name: LimeSurvey 4.1.11 - Local File Inclusion author: daffainfo severity: critical...

-Limesurvey-RCE-CVE-2021-44967

🚀 LimeSurvey RCE CVE-2021-44967 - Авторизованное удаленное выполнение кода Этот репозиторий содержит функциональный эксплойт для CVE-2021-44967 — уязвимости авторизованного удаленного выполнения кода в LimeSurvey. 🎯 Совместимость Протестировано и подтверждена работа на: LimeSurvey 5.2.x LimeSurve...

CVE-2021-44967

CVE-2021-44967 root@kitploit: Exploit Title: LimeSurvey 5.2.4 - Authenticated Remote Code Execution RCE Google Dork: inurl:limesurvey/index.php/admin/authentication/sa/login Date: 05/12/2021 Discovered by: Y1LD1R1M Exploit Author: D3Ext Vendor Homepage: https://www.limesurvey.org/ Software Link:...

CVE-2026-65931

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey...

CVE-2026-65931 LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey...

EUVD-2026-67164

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey...

CVE-2026-65931

LimeSurvey Community Edition 7.0.5 has an improper authorization flaw in the survey menu entry creation endpoint (POST /index.php/admin/menuentries/sa/create ). An authenticated user holding only the settings:read permission can invoke this endpoint and create new survey menu entries without the ...

EUVD-2026-66766

LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5...

EUVD-2026-66773

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

EUVD-2026-66771

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...

CVE-2026-65930

LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5...

CVE-2026-63360

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-16809

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...

CVE-2026-63360 LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-63360 LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-63360

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting (XSS) vulnerability in the user activation confirmation endpoint . The root cause is that the action query parameter is copied into the response and inserted into a hidden input attribute without HT...