What’s Vulnerable › Vulnerabilities

CVE-2025-41074: Multiple vulnerabilities in Limesurvey

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-20 · updated 2026-10-19
• Weakness: CWE-835

Description

Vulnerability in LimeSurvey 6.13.0 in the endpoint /optout that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability.

Affected products

• LimeSurvey: 6.13.0

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey-0

Get alerted when CVE-2025-41074 or the next vulnerability affects your stack