CVE-2018-10228

MediumCVSS 6.1

Published: 14/12/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.81%

52th percentile - higher than 52% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability was found in LimeSurvey 3.6.2+180406 in the theme.php controller. Attackers can inject arbitrary web script or HTML via the changes_cp parameter in requests to the index.php/admin/themes/sa/templatesavechanges URI.

Risk Assessment

The risk involves execution of malicious scripts in the administrator's browser, potentially leading to session theft, account takeover, or system configuration changes.

Recommendation

Update LimeSurvey to the latest patched version immediately. Additionally, implement input validation and Content-Security-Policy headers to mitigate XSS risks.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web script or HTML via the changes_cp parameter to the index.php/admin/themes/sa/templatesavechanges URI.