CVE-2019-16187: Limesurvey

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script.

Affected products

• Limesurvey Limesurvey: before 3.17.14 (fixed in 3.17.14)

Published 2019-09-09. Last modified 2026-06-17.