CVE-2025-63238 | THREATINT

Description

A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter in getInstance() function in application/models/QuestionCreate.php. This allows an attacker to craft a malicious URL and compromise the logged in user.

PUBLISHED Reserved 2025-10-27 | Published 2026-04-09 | Updated 2026-04-10 | Assigner mitre

References

github.com/...ommit/80769a677dc82ddb1fcced4af19bd959d583208d

gist.github.com/masquerad3r/f913ab479e8de2ad71987ef98a088fb5

cve.org (CVE-2025-63238)

nvd.nist.gov (CVE-2025-63238)

Download JSON