CVE-2026-50636
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
SQL Injection vulnerability in LimeSurvey RemoteControl API methods (invite_participants and remind_participants). An attacker with tokens/update permission can inject SQL via unsanitized input. With RPCInterface enabled and emulated prepared statements, attacker can read admin password hashes and other data, and modify the database.
Risk Assessment
Risk of full admin account takeover, leakage of respondent PII, and database destruction. Attack can be performed remotely by an authenticated user.
Recommendation
Disable RemoteControl interface (RPCInterface) if not needed. Upgrade LimeSurvey to a patched version. Disable emulated prepared statements in PDO configuration.
Other vulnerabilities in LimeSurvey
See all- CVE-2025-56422Critical
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.
- CVE-2026-65931Medium
LimeSurvey Community Edition 7.0.5 contains an improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without the expected settings:update privilege. The endpoint also allows the attacker to submit menu IDs that the normal interface restricts for non-superadministrators, enabling unauthorized changes to administrative navigation records.
- CVE-2026-65930Medium
LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor. This issue affects LimeSurvey 7.0.5.
- CVE-2026-63360High
LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The 'action' query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding.
- CVE-2026-16809High
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message.
- CVE-2026-15973High
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries admin page. An authenticated user with global settings:read permission can create a survey menu entry with attacker-controlled data. The value is stored and later inserted into a single-quoted HTML title attribute without proper encoding.
- CVE-2026-18403Medium
LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.
- CVE-2026-63361High
LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding.
- CVE-2026-63107High
LimeSurvey up to versions 6.17.10 and 7.0.4 contains an SSRF vulnerability in the REST API survey template endpoint. Authenticated users can manipulate the Host header, causing the server to issue arbitrary HTTP requests, enabling access to internal network services and cloud metadata endpoints.
- CVE-2026-50635High
LimeSurvey constructs password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist is undefined in the default configuration, so LSHttpRequest::checkIsAllowedHost() results in no operation. A remote, unauthenticated attacker who submits a forgotten-password request for a known account with a spoofed Host header causes LimeSurvey to email a reset link with an attacker-controlled hostname while embedding the genuine validation_key. When the recipient or an automated inbound mail-security link scanner dereferences the link, the valid reset token is disclosed to the attacker, who replays it against the legitimate host's newPassword endpoint to set a new password and take over the account.
Original NVD description (English source)
The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which concatenates the values directly into a tid IN ('...') SQL clause without parameterization or input validation. A remote, authenticated attacker holding the tokens/update permission on a survey can inject a crafted array element to perform SQL injection. Because LimeSurvey configures its PDO connection with emulated prepared statements (emulatePrepare = true) and does not disable MySQL multi-statements, the injection supports stacked queries: the attacker can append arbitrary additional statements (INSERT/UPDATE/DELETE/DROP/CREATE) after the original SELECT. This permits both arbitrary read of any data in the database, such as administrator bcrypt password hashes (lime_users), survey response PII, session records, and global settings, all recoverable via a SLEEP() time-based blind oracle, and arbitrary write/destruction of that data, including directly overwriting the administrator password hash for immediate account takeover or dropping/truncating tables. Reads and writes extend to any schema the application's database user can access. The RemoteControl interface (RPCInterface = json/xml) must be enabled, which is not the default.