CVE-2026-18403

6.0 mediumEPSS 0.4%

Medium (6.0). EPSS 0.4% chance of exploitation in the next 30 days.

LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.

Severity

CVSS 4.0

6.0 medium

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-08-14
Modified: 2026-08-28
Record from: the NVD, synced 2026-10-19

References

https://fluidattacks.com/es/advisories/rihanna
https://github.com/LimeSurvey/LimeSurvey/
https://github.com/LimeSurvey/LimeSurvey/commit/7735ce31cea1cad087b0c8556cb65a1c09e29cbd
https://fluidattacks.com/es/advisories/rihanna

Check your stack JSON