CyberRota Analysis
AI-GeneratedAn authenticated user in LimeSurvey Community Edition 7.4.0 can exploit a vulnerability by injecting a malicious JavaScript value into the date_min attribute of a Date/Time question, which is then improperly rendered in a JavaScript context. This leads to potential cross-site scripting (XSS) attacks, allowing attackers to execute arbitrary JavaScript in the context of other users' sessions. Organizations using this version of LimeSurvey should prioritize patching to mitigate the risk of XSS and protect user data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted inline JavaScript literal without JavaScript-context encoding.