6 matches found
CVE-2021-42112
The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js...
CVE-2021-42112
CVE-2021-42112 affects LimeSurvey 3.x-LTS up to 3.27.18, where the File upload question feature enables cross-site scripting in assets/scripts/modaldialog.js and assets/scripts/uploader.js. The vulnerability is described across multiple feeds and CVSS scores indicate a likely medium severity (CVS...
CVE-2021-42112: Improper Neutralization of Input During Web Page Generation
The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js...
CVE-2018-16397
In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file,...
PT-2018-13546
Name of the Vulnerable Software and Affected Versions LimeSurvey versions prior to 3.14.7 Description The issue allows an admin user to read an arbitrary file by leveraging a "file upload" question. Recommendations For versions prior to 3.14.7, update to version 3.14.7 or later to resolve the iss...