Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
CVE-2024-28709: LimeSurvey 6.5.12 and earlier: Malicious scripts injected via survey comments
CVE-2024-28709 · published 2 years ago
Summary
A security weakness in LimeSurvey's survey comments feature allows an attacker to inject malicious code, potentially allowing them to take control of your website. This is a serious issue because an attacker could exploit it to steal sensitive information or disrupt your site. To fix this, update to LimeSurvey 6.5.12 or later.
What to do
- Update limesurvey limesurvey to version 6.5.12.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | limesurvey | limesurvey |
< 6.5.12 Fix: upgrade to 6.5.12
|
| – | limesurvey | limesurvey |
< 6.5.12\+240611 cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:* |
Original advisory text
Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and comment fields.
Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and comment fields.
References
- https://www.limesurvey.org
- http://limesurvey.com
- https://github.com/advisories/GHSA-c7xm-rwqj-pgcj
- https://nvd.nist.gov/vuln/detail/CVE-2024-28709 Vendor Advisory
- https://github.com/LimeSurvey/LimeSurvey/commit/c844c4fba81cc26ffe6544bf095bad62... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28709... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published7 Oct 2024
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta