{"id":"CVE-2019-16172","aliases":["GHSA-fr47-r224-c36m"],"url":"https://o3.security/vulnerability/CVE-2019-16172","summary":"Cross-site Scripting in LimeSurvey","details":"LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.","published":"2019-09-09T19:15:11.190Z","modified":"2026-08-07T14:52:40.940616Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":6,"affectedPackages":[{"ecosystem":"Packagist","name":"limesurvey/limesurvey","fixedVersion":"3.17.14"}],"fix":{"url":"https://github.com/LimeSurvey/LimeSurvey/commit/32d6a5224327b246ee3a2a08500544e4f80f9a9a","label":"LimeSurvey/LimeSurvey@32d6a52"},"references":[{"type":"WEB","url":"https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released"},{"type":"FIX","url":"https://github.com/LimeSurvey/LimeSurvey/commit/32d6a5224327b246ee3a2a08500544e4f80f9a9a"},{"type":"EVIDENCE","url":"http://packetstormsecurity.com/files/154479/LimeSurvey-3.17.13-Cross-Site-Scripting.html"},{"type":"EVIDENCE","url":"http://seclists.org/fulldisclosure/2019/Sep/22"},{"type":"EVIDENCE","url":"https://seclists.org/bugtraq/2019/Sep/27"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T14:52:40.940616Z"}}