Description
A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file.
References (2)
Scores
CVSS v3
9.8
EPSS
0.0058
EPSS Percentile
68.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-1236
Status
published
Products (1)
limesurvey/limesurvey
< 3.17.14
Published
Sep 09, 2019
Tracked Since
Feb 18, 2026