CVE-2025-41375

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-41375
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-41375.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-41375
Published
2025-08-01T13:15:27.257Z
Modified
2026-04-10T05:26:29.596392Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability allows an attacker to retrieve, create, update and delete database via 'token' parameter in '/index.php' endpoint.

References

Affected packages

Git / github.com/limesurvey/limesurvey

Affected ranges

Type
GIT
Repo
https://github.com/limesurvey/limesurvey
Events
Introduced
d74e427319990e9ed933166109771da1020f8d7e
Fixed
2ef1525baed6eb977b5aa50ed02b26bb072a483c
Database specific 
{
    "versions": [
        {
            "introduced": "2.65.1"
        },
        {
            "fixed": "3.0.0"
        }
    ]
}

Affected versions

2.*
2.65.0+170522
2.65.1+170522
2.65.2+170606
2.65.4+170612
2.66.6+170619
2.67.0+170622
2.67.1+170626
2.67.2+170719
2.67.2+170728
2.67.3+170728
2.71.0+170925
2.71.1+170927
2.72.0+171010
2.72.2+171017
2.72.3+171020
2.72.4+171110
2.72.5+171121
2.72.6+171207
2.73.0+171219

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-41375.json"