CVE-2019-16172

CVE-2019-16172 The CVE-2019-16172 Scanner is designed to check LimeSurvey instances for the stored XSS vulnerability. CVE Descriptions CVE-2019-16172 Description: CVE-2019-16172 is a stored XSS vulnerability found in LimeSurvey versions prior to 3.17. The vulnerability arises due to improper...

CVE-2026-8337

CVE-2026-8337 CVE-2026-8337 is an Insecure Direct Object Reference IDOR vulnerability in Concrete CMS that affects the Survey feature. Unlike CVE-2026-8347 which involved Express associations, this vulnerability allows an unauthenticated attacker to participate in a restricted/private survey unde...

EUVD-2026-80860

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses...

CVE-2026-92602

TDuck survey form through version 5.3 is affected by a Server-Side Request Forgery vulnerability in the WebhookConfigController . The root cause is a failure to validate webhook URLs or verify form ownership, allowing authenticated attackers to attach webhooks to other users' forms and exfiltrate...

CVE-2026-92567

TDuck survey form through version 5.0 has an authorization bypass in the POST /user/form/data/update endpoint. Authenticated users can overwrite other users' form submission data because the update request lacks ownership validation , and submission identifiers are allocated in narrow ranges that...

PowerSharpPack

Sponsored by PowerSharpPack Many useful offensive CSharp Projects wraped into Powershell for easy usage. Why? In my personal opinion offensive Powershell is not dead because of AMSI, Script-block-logging, Constrained Language Mode or other protection features. Any of these mechanisms can be...

CVE-2022-46484

CVE-2022-46484 Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbitrarily submit surveys...

CVE-2021-40101

Survey XSS combined with CSRF leads to Admin Account Takeover in Concrete5 8.5.4 A Concrete CMS admin in versions below 9 did not have to provide their password when changing another user's password. In combination with CVE-2021-28145 "Concrete CMS formerly concrete5 before 8.5.5 allows remote...

CVE-2026-62140

Unauthenticated Insecure Direct Object References IDOR in Quiz And Survey Master = 11.2.5 versions...

CVE-2026-82535

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint...

EUVD-2026-76216

Unauthenticated Insecure Direct Object References IDOR in Quiz And Survey Master = 11.2.5 versions...

CVE-2026-62140 WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Quiz And Survey Master = 11.2.5 versions...

CVE-2026-62140

CVE-2026-62140 affects the WordPress plugin Quiz And Survey Master in versions

EUVD-2026-76159

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint...

CVE-2026-82535 Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint...

CVE-2026-82535

Chamilo LMS versions before 1.11.42 and 3.0.0 contain a stored cross-site scripting (XSS) vulnerability in the survey answer submission flow. Unauthenticated attackers can inject malicious script payloads into survey answers by computing deterministic invitation codes that bypass authorization ch...

CVE-2026-82535 Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint...

PT-2026-90003

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint...

WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Adam Kahlon Adkali in WordPress Plugin Quiz And Survey Master versions = 11.2.5...

WordPress Quiz and Survey Master (QSM) plugin < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure vulnerability

Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Quiz And Survey Master versions 11.2.4...