CVE PROGRAM SOURCE RECORDUnscored

CVE-2018-10228

Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web script or HTML via th

Status: Published
Published: 2021-12-14
Updated: 2026-07-09
Assigning organization: mitre

Description

Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web script or HTML via the changes_cp parameter to the index.php/admin/themes/sa/templatesavechanges URI.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a n/a

n/aaffected

References

https://github.com/LimeSurvey/LimeSurvey/blob/d0e0c94042fdb5119c9247dc2d57685334492e71/application/controllers/admin/themes.php#L644-L654 ↗