CVE-2018-17003

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-21 · updated 2026-06-17
Weakness: CWE-79

Description

In LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the surveyls_title parameter to /index.php?r=admin/survey/sa/insert.

Affected products

LimeSurvey: 3.14.7

References

http://packetstormsecurity.com/files/149435/LimeSurvey-3.14.7-Cross-Site-Scripting.html
http://packetstormsecurity.com/files/149435/LimeSurvey-3.14.7-Cross-Site-Scripting.html

Get alerted when CVE-2018-17003 or the next vulnerability affects your stack