CyberRota Analysis
AI-GeneratedLimeSurvey Community Edition 7.0.5 is vulnerable to an authenticated reflected cross-site scripting (XSS) flaw in the HTML editor popup, where user-supplied input is inadequately sanitized and rendered without proper output encoding. This vulnerability could allow attackers to execute arbitrary scripts in the context of the user's session, potentially leading to data theft or session hijacking. Organizations using this version of LimeSurvey should prioritize remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding.