Cross-site Scripting (XSS)

LimeSurvey is vulnerable to cross-site scripting XSS. An authenticated users with correct permissions is able to inject and execute malicious script via the parameter ParticipantAttributeNamesDropdown of the Attributes on the central participant database page...

CVE-2020-25798: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject arbitrary web script or HTML via parameter ParticipantAttributeNamesDropdown of the Attributes on the central participant database page. When the...