CyberRota Analysis
AI-GeneratedLimeSurvey Community Edition versions 7.0.5 and later are vulnerable to an authenticated reflected Cross-Site Scripting (XSS) flaw in the user activation confirmation endpoint, where the action query parameter is improperly handled. This vulnerability allows attackers to inject malicious scripts into the application, potentially compromising user sessions and data integrity. Organizations using affected versions should prioritize patching this issue to safeguard against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This issue affects LimeSurvey: 7.0.5.