What’s Vulnerable › Vulnerabilities

CVE-2021-44967

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 13.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-02-24 · updated 2026-06-17
• Weakness: CWE-434

Description

A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be installed by a superadmin, and therefore the security model is not violated by this finding.

Affected products

• LimeSurvey: 5.2.4

References

• https://github.com/Y1LD1R1M-1337/Limesurvey-RCE
• https://www.exploit-db.com/exploits/50573
• https://www.limesurvey.org/manual/Plugins_-_advanced
• https://github.com/Y1LD1R1M-1337/Limesurvey-RCE
• https://www.exploit-db.com/exploits/50573

Get alerted when CVE-2021-44967 or the next vulnerability affects your stack