Limesurvey

Limesurvey is a widely deployed open-source survey and data-collection platform that, despite a narrow product portfolio, occupies a prominent position in the vulnerability landscape and presents a substantial attack surface through its web-facing deployment model. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity and a corresponding tendency toward public exploit code availability, reflecting the application's exposure to internet-connected threat actors. The recurring weakness classes—cross-site scripting, SQL injection, insecure file uploads, and cross-site request forgery—are characteristic of web-application input handling and session-management boundaries, and they recur persistently across the vendor's release cycle. Defenders should treat Limesurvey instances as requiring prompt patching, particularly where survey forms are internet-accessible or handle sensitive data collection, and should inventory deployed instances across their organizations. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.