CVE-2026-18403: medium-severity vulnerability in LimeSurvey
LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6epss 0.4%
exploitation probability
0.4%top 70% of all CVEs
observed exploitation
nono source reports it
LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
LimeSurvey · LimeSurveyRelated CVEs — LimeSurvey
In the same product, most dangerous first.
CVE-2026-50635HIGHLimeSurvey Password Reset Host Header Injection Discloses Reset TokenEPSS 0.7%CVE-2025-41375CRITICALSQL Injection in LimesurveyEPSS 0.6%CVE-2026-50636HIGHLimeSurvey RemoteControl invite_participants/remind_participants SQL InjectionEPSS 0.6%CVE-2026-63361HIGHLimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popupEPSS 0.5%CVE-2025-41376MEDIUMCRLF Injection in LimesurveyEPSS 0.5%CVE-2026-63360HIGHLimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpointEPSS 0.5%