CVE-2025-63238: Limesurvey

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of gid parameter in getInstance() function in application/models/QuestionCreate.php. This allows an attacker to craft a malicious URL and compromise the logged in user.

Affected products

• Limesurvey Limesurvey: before 6.15.12 (fixed in 6.15.12)

Published 2026-04-09. Last modified 2026-06-17.