CVE-2015-4628: Limesurvey

Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days.

SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authenticated administrators to execute arbitrary SQL commands via the sid parameter.

Affected products

• Limesurvey Limesurvey: up to and including 2.06\+

Published 2015-06-18. Last modified 2026-06-17.