{"id":"CVE-2019-16173","aliases":["GHSA-r5f2-4wf4-cv66"],"url":"https://o3.security/vulnerability/CVE-2019-16173","summary":"Cross-site Scripting in LimeSurvey","details":"LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php,","published":"2019-09-09T19:15:11.283Z","modified":"2026-08-07T14:52:41.932203Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":4,"affectedPackages":[{"ecosystem":"Packagist","name":"limesurvey/limesurvey","fixedVersion":"3.17.14"}],"fix":{"url":"https://github.com/LimeSurvey/LimeSurvey/commit/f1c1ad2d24eb262363511fcca2e96ce737064006","label":"LimeSurvey/LimeSurvey@f1c1ad2"},"references":[{"type":"WEB","url":"https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released"},{"type":"FIX","url":"https://github.com/LimeSurvey/LimeSurvey/commit/f1c1ad2d24eb262363511fcca2e96ce737064006"},{"type":"EVIDENCE","url":"http://packetstormsecurity.com/files/154479/LimeSurvey-3.17.13-Cross-Site-Scripting.html"},{"type":"EVIDENCE","url":"http://seclists.org/fulldisclosure/2019/Sep/22"},{"type":"EVIDENCE","url":"https://seclists.org/bugtraq/2019/Sep/27"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T14:52:41.932203Z"}}