CVE-2025-41075: falha de média gravidade em LimeSurvey
Multiple vulnerabilities in Limesurvey
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.3%
Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
LimeSurvey · LimeSurveyCVEs relacionadas — LimeSurvey
No mesmo produto, das mais perigosas para as menos.
CVE-2025-41375CRITICALSQL Injection in LimesurveyEPSS 0.7%CVE-2025-41376MEDIUMCRLF Injection in LimesurveyEPSS 0.6%CVE-2026-92730HIGHLimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column nameEPSS 0.5%CVE-2026-63361HIGHLimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popupEPSS 0.5%CVE-2026-91775HIGHLimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warningsEPSS 0.5%CVE-2026-63360HIGHLimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpointEPSS 0.5%