CVE-2024-42902: Limesurvey

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js_localize.php function

Affected products

• Limesurvey Limesurvey: up to and including 6.6.2

Published 2024-09-03. Last modified 2026-06-17.