{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-70797", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-09T21:21:54.090Z", "dateReserved": "2026-01-09T00:00:00.000Z", "datePublished": "2026-04-09T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-09T17:16:05.267Z"}, "descriptions": [{"lang": "en", "value": "Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box[title] and box[url] parameters."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://gist.github.com/masquerad3r/772ddbfbd9fd95754f4873bcb202146d"}, {"url": "https://github.com/LimeSurvey/LimeSurvey/pull/4356"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T21:21:49.602806Z", "id": "CVE-2025-70797", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T21:21:54.090Z"}}]}, "dataVersion": "5.2"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:limesurvey:limesurvey:6.15.20:251021:*:*:*:*:*:*", "matchCriteriaId": "B1F979B9-D9F1-4062-BD61-421EE4859C85", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box[title] and box[url] parameters."}], "id": "CVE-2025-70797", "lastModified": "2026-04-16T19:01:01.583", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-04-09T18:16:42.547", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://gist.github.com/masquerad3r/772ddbfbd9fd95754f4873bcb202146d"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking"], "url": "https://github.com/LimeSurvey/LimeSurvey/pull/4356"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.15.20+251021"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "limesurvey", "vendor": "limesurvey"}], "analysis": {"en": {"generated_at": "2026-04-09T23:28:35.326027+00:00", "value": {"mitigation_remediation": ["Upgrade LimeSurvey to the newest patch release that addresses the XSS flaw.", "If a patch cannot be applied immediately, restrict write access to the Box[title] and box[url] parameters or remove the ability for untrusted users to manipulate them.", "Implement output encoding or input validation for all user\u2011supplied data before rendering it in the browser.", "Review application logs for unexpected XSS patterns and monitor for suspicious activity."], "summary": {"action": "Patch immediately", "impact": "Remote Code Execution via XSS"}, "threat_synthesis": {"affected_systems": "LimeSurvey users running version 6.15.20+251021 are affected. No other products or vendors are currently listed. The issue is tied to the Box module that accepts title and URL fields from administrators or content editors.", "description_and_impact": "The vulnerability is a cross\u2011site scripting flaw present in LimeSurvey starting at version 6.15.20+251021. Malicious input supplied to the Box[title] and box[url] parameters can be rendered unfiltered, enabling an attacker to inject arbitrary client\u2011side code that runs in the browser of users visiting the affected page. Such code execution may lead to the theft of user credentials, session hijacking, or further exploitation of backend services if additional weaknesses exist. The weakness maps to CWE\u201179 and sits at a moderate severity level with a CVSS score of 6.1.", "risk_and_exploitability": "Exploit feasibility requires that an attacker can provide malicious input to the box[title] or box[url] fields, which is achievable remotely if the administrator interface is accessible or if the parameters are exposed via a public\u2011facing API. Although no EPSS score is available, the CVSS score of 6.1 indicates a moderate risk, and the vulnerability is not yet recorded in the CISA Known Exploited Vulnerabilities catalog. If abused, the impact could be persistent client\u2011side compromise for all users who view the malicious content."}}}}, "created": "2026-04-10T08:53:59.772754+00:00", "title": "Cross\u2011Site Scripting in LimeSurvey Box Parameters Allows Remote Code Execution", "updated": "2026-04-10T09:33:09.741985+00:00", "vendors": ["limesurvey", "limesurvey$PRODUCT$limesurvey"]}