CVE-2025-15479

MediumCVSS 5.4

Published: 07/01/2026(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

26th percentile - higher than 26% of all known CVEs

Summary

Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 has a stored XSS (CWE-79) vulnerability in survey content and administration functionality. Authenticated users with survey creation or edit privileges can execute arbitrary JavaScript in other users' browsers, steal session information, and perform unauthorized actions.

Risk Assessment

An attacker can hijack user sessions and perform actions on their behalf, potentially leading to data integrity and privacy breaches.

Recommendation

Update NGSurvey to a version with proper output encoding and restrict survey creation privileges.

Other vulnerabilities in NGSurvey

CVE-2025-13829High
An Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved includes APIKEY (1 year user session), RefreshToken (10 minutes user session), Password hashed with bcrypt, User IP, Email, and Full Name.

Original NVD description (English source)

Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms ( on Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users’ browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS