CyberRota Analysis
AI-GeneratedLimeSurvey Community Edition 7.0.5 is vulnerable to a stored cross-site scripting (XSS) flaw in the Survey Menu Entries administration page, allowing authenticated users with read permissions to inject malicious scripts through survey menu entries. This vulnerability could lead to unauthorized access to sensitive data or session hijacking, posing a significant risk to users and their data integrity. Organizations using this version of LimeSurvey should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-controlled data. The value is stored in the surveymenu_entries.data field and later inserted into a single-quoted HTML title attribute without context-appropriate encoding. This issue affects LimeSurvey: 7.0.5.