https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-70797.htmlhttps://patchthecve.com/cve/CVE-2025-70797.htmlThu, 15 Oct 2026 12:10:00 +0000MEDIUM 6.1: Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box[title] and box[url] parameters.https://patchthecve.com/cve/CVE-2025-63238.htmlhttps://patchthecve.com/cve/CVE-2025-63238.htmlThu, 15 Oct 2026 12:10:00 +0000MEDIUM 6.1: A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter in getInstance() function in application/models/QuestionCreate.php. This allows an attacker to craft a malicious URL and compromise the logged in user.https://patchthecve.com/cve/CVE-2025-56422.htmlhttps://patchthecve.com/cve/CVE-2025-56422.htmlSun, 05 Jul 2026 02:17:00 +0000CRITICAL 9.8: A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.https://patchthecve.com/cve/CVE-2025-56421.htmlhttps://patchthecve.com/cve/CVE-2025-56421.htmlSun, 05 Jul 2026 02:17:00 +0000HIGH 7.5: SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.https://patchthecve.com/cve/CVE-2020-36993.htmlhttps://patchthecve.com/cve/CVE-2020-36993.htmlWed, 17 Jun 2026 03:16:42 +0000MEDIUM 5.4: LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administration panel. Attackers can inject malicious SVG scripts through the Surveymenu[title] and Surveymenu[parent_id] parameters to execute arbitrary JavaScript in administrative context