CVE-2024-28709

MediumCVSS 6.1

Published: 07/10/2024(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

40th percentile - higher than 40% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability was found in LimeSurvey before version 6.5.12+240611. A remote attacker can execute arbitrary code via a crafted script in the title and comment fields.

Risk Assessment

The risk includes session hijacking, admin account takeover, or injection of malicious JavaScript, potentially leading to data confidentiality and integrity breaches.

Recommendation

Immediately upgrade LimeSurvey to version 6.5.12+240611 or later. Additionally, implement input filtering and output encoding for form fields.

Original NVD description (English source)

Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and comment fields.