CVE-2018-20322: Limesurvey

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code execution against LimeSurvey administrators. Fixed in version 3.15.6.

Affected products

• Limesurvey Limesurvey: up to and including 3.15.5

Published 2018-12-21. Last modified 2026-06-17.