CVE-2026-18403CWE-89sql-injection

CVE-2026-18403

published August 14, 2026

CVSS

6.0

EPSS

Percentile

30.4

In the wild

Unconfirmed

What it is

LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.

The record

Technical detail

CVSS: 6.0 · NONE
CVSS v4.0: 6.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00377 · 30.4th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-08-14T23:17Z

References (4)

https://fluidattacks.com/es/advisories/rihanna · [email protected]https://github.com/LimeSurvey/LimeSurvey/ · [email protected]https://github.com/LimeSurvey/LimeSurvey/commit/7735ce31cea1cad087b0c8556cb65a1c09e29cbd · [email protected]https://fluidattacks.com/es/advisories/rihanna · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

14 AUG 18:33Z
LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB
cvelistv5