What’s Vulnerable › Vulnerabilities
CVE-2025-41076: Multiple vulnerabilities in Limesurvey
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-11-20 · updated 2026-10-19
- Weakness: CWE-209
Description
In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the conflict. This information can simplify the collection of data about the internal architecture of the application by an attacker.
Affected products
- LimeSurvey: 6.13.0
References
Get alerted when CVE-2025-41076 or the next vulnerability affects your stack