PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-70797 LimeSurvey CVE debrief

A Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box[title] and box[url] parameters. The CVE record was published on 2026-04-09T18:16:42.547Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability affects Limesurvey installations, and defenders should assess exposure and prioritize verification and mitigation efforts to prevent potential code execution. The vulnerability's impact is considered Medium with a CVSS score of 6.1.

Vendor
LimeSurvey
Product
LimeSurvey
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-09
Original CVE updated
2026-10-15
Advisory published
2026-04-09
Advisory updated
2026-10-15

Who should care

Defenders responsible for Limesurvey installations should assess exposure and prioritize verification and mitigation. This includes administrators, security teams, and IT personnel who manage Limesurvey deployments. They should review the CVE record and NVD entry for detailed information and consider applying patches or mitigations to prevent potential code execution. Additionally, they should monitor for potential 3

Why it matters

Defenders should prioritize verifying and mitigating the Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 to prevent potential code execution.

  • Potential code execution requires verification from official sources
  • Defenders must verify Limesurvey v.6.15.20+251021 installations for vulnerability
  • Mitigations or patches may be necessary to prevent exploitation

Technical summary

The vulnerability exists in Limesurvey v.6.15.20+251021 and allows a remote attacker to execute arbitrary code via the Box[title] and box[url] parameters. This Cross Site Scripting vulnerability can be exploited by an attacker to execute malicious scripts in the context of a user's session, potentially leading to unauthorized actions or data breaches. Defenders should prioritize verifying the vulnerability in Limesurvey v.6.15.20+251021 and applying patches or mitigations to prevent potential code execution.

Defensive priority

Defenders should prioritize verifying the vulnerability in Limesurvey v.6.15.20+251021 and applying patches or mitigations to prevent potential code execution.

Recommended defensive actions

  • Verify Limesurvey v.6.15.20+251021 installations for potential vulnerability
  • Apply patches or mitigations to prevent code execution
  • Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD vulnerability detail page provide information about the vulnerability, but do not offer specific details on exploitation or impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-70797 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-70797

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-70797 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-70797

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.