CVE-2020-25798

A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject…

published November 17, 2020

CVSS
—
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject arbitrary web script or HTML via parameter ParticipantAttributeNamesDropdown of the Attributes on the central participant database page. When the survey attribute being edited or viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00645 · 50.3th percentile
Published
2020-11-17T14:21Z
EPSS history
Timeline
  • 17 NOV 14:21Z
    A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject…
    cvelistv5