CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Python 3 checker and configurable exploit hook for CVE-2026-90817 Securifera / Ryan Wincey. | ---|--- Product| REDCap Vanderbilt Affected| ≥ 13.3.0 until branch patch Fixed| 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard+ CVSS 3.1| 9.8 Critical...

CVE-2022-46484

CVE-2022-46484 Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbitrarily submit surveys...

CVE-2026-8337

CVE-2026-8337 CVE-2026-8337 is an Insecure Direct Object Reference IDOR vulnerability in Concrete CMS that affects the Survey feature. Unlike CVE-2026-8347 which involved Express associations, this vulnerability allows an unauthenticated attacker to participate in a restricted/private survey unde...

Malware in @flexmr/survey-client

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @flexmr/survey-conversation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Python 3 checker and configurable exploit hook for CVE-2026-90817 Securifera / Ryan Wincey. | ---|--- Product| REDCap Vanderbilt Affected| ≥ 13.3.0 until branch patch Fixed| 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard+ CVSS 3.1| 9.8 Critical...

PowerSharpPack

Sponsored by PowerSharpPack Many useful offensive CSharp Projects wraped into Powershell for easy usage. Why? In my personal opinion offensive Powershell is not dead because of AMSI, Script-block-logging, Constrained Language Mode or other protection features. Any of these mechanisms can be...

CVE-2019-16172

CVE-2019-16172 The CVE-2019-16172 Scanner is designed to check LimeSurvey instances for the stored XSS vulnerability. CVE Descriptions CVE-2019-16172 Description: CVE-2019-16172 is a stored XSS vulnerability found in LimeSurvey versions prior to 3.17. The vulnerability arises due to improper...

CVE-2021-40101

Survey XSS combined with CSRF leads to Admin Account Takeover in Concrete5 8.5.4 A Concrete CMS admin in versions below 9 did not have to provide their password when changing another user's password. In combination with CVE-2021-28145 "Concrete CMS formerly concrete5 before 8.5.5 allows remote...

REDCap 17.4.3 Survey Passthru Data Import RCE Checker

REDCap versions 13.3.0 through affected pre-fixed branches contain a survey passthru and Data Import path/stream handling issue that may allow remote code execution. This tool fingerprints targets, validates public survey hashes, and probes passthru routes...

CVE-2026-111408

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-111408

The Quiz And Survey Master WordPress plugin (versions

CVE-2026-111408 WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-111408 WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

EUVD-2026-104133

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-111408: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ihsan Saddan in WordPress Plugin Quiz And Survey Master versions = 11.2.7...

CVE-2026-111621

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

CVE-2026-111621 TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

CVE-2026-111621

The TDuck Survey Form software (versions through 5.3 ) is vulnerable to a missing authorization flaw (CWE-639) in the /user/form/setting/{key} endpoint. This vulnerability allows any authenticated user to access the raw form settings of other owners by providing an 8-character form key obtained f...