Back to CVE Browser

CVE-2019-25019

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1880%

EPSS Percentile35.81th

PublishedFeb 14, 2021

Last ModifiedNov 21, 2024

Vulnerability Description

LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model.

Affected Platforms (CPE)

📦

Limesurvey

Limesurvey

< 3.19.0

📦

Limesurvey

Limesurvey

= 4.0.0

📦

Limesurvey

Limesurvey

= 4.0.0

📦

Limesurvey

Limesurvey

= 4.0.0

📦

Limesurvey

Limesurvey

= 4.0.0

📦

Limesurvey

Limesurvey

= 4.0.0

References & Advisories

🔗 https://community.limesurvey.org/release/191008/

🔗 https://github.com/LimeSurvey/LimeSurvey/blob/master/docs/release_notes.txt

🔗 https://community.limesurvey.org/release/191008/

🔗 https://github.com/LimeSurvey/LimeSurvey/blob/master/docs/release_notes.txt

Related Vulnerabilities

CVE-2020-114559.8

LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php...

CVE-2019-99609.8

The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.

CVE-2019-161849.8

A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their ...

CVE-2008-25709.3

Multiple unspecified vulnerabilities in LimeSurvey (formerly PHPSurveyor) before 1.71 have unknown impact and attack vectors.