CVE-2025-63238

A Reflected Cross-Site Scripting XSS affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter in getInstance function in application/models/QuestionCreate.php. This allows an attacker to craft a malicious URL and compromise the logged in user...

CVE-2025-63238

A Reflected Cross-Site Scripting XSS affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter in getInstance function in application/models/QuestionCreate.php. This allows an attacker to craft a malicious URL and compromise the logged in user...

PT-2026-31653

Name of the Vulnerable Software and Affected Versions LimeSurvey versions prior to 6.15.11+250909 Description Reflected Cross-Site Scripting XSS occurs due to insufficient validation of the gid parameter within the getInstance function located in application/models/QuestionCreate.php. This flaw...