HIGH 7.4 NVD

CVE-2026-63360

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. T

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This issue affects LimeSurvey: 7.0.5.

References

https://fluidattacks.com/advisories/raine
https://github.com/LimeSurvey/LimeSurvey

Published: 2026-08-26 · Source: NVD · Feed updated: 2026-08-26

This high severity vulnerability with a CVSS score of 7.4 was published on 2026-08-26 via NVD.

vulnfeed aggregates 11128 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.