high7.5
CVE-2025-56421
LimeSurvey is vulnerable to SQL injection
Impact
SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | limesurvey/limesurvey | < 6.15.4 | 6.15.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Limesurvey | Limesurvey | through 6.15.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/hongancalif/security-advisories/blob/main/CVE-2025-56421.md
- https://github.com/advisories/GHSA-rccq-2fxq-7x3h
- https://nvd.nist.gov/vuln/detail/CVE-2025-56421
- http://limesurvey.com
- https://github.com/LimeSurvey/LimeSurvey/pull/4328
- https://github.com/LimeSurvey/LimeSurvey/commit/d6c3c780cdd17d5eef1c8c69ad0105beffa2374f