CVE-2019-16174

8.8 highEPSS 2.4%

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 2.4% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2019-09-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

limesurvey:limesurvey

References

https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R40
https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released
https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R40
https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released

Check your stack JSON