UpHeron
All vulnerabilities

Servers and applications

CVE-2018-10228

Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web script or HTML via the changes_cp parameter to the index.php/admin/themes/sa/templatesavechanges URI.

Severity
Medium 6.1
Published
14 Dec 2021
Last changed
9 Jul 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
LimeSurveyServers and applications · cpe:a:limesurvey:limesurvey
  • Version 3.6.2-180406

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-10228
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-10228