CVE-2026-91775

— UNSCOREDpublic exploit available

Published 2026-09-23 · Updated 2026-09-23

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

LimeSurvey fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.

Weaknesses

CWE-79

Public exploit & PoC references

https://github.com/LimeSurvey/LimeSurvey
https://github.com/LimeSurvey/LimeSurvey/commit/c96db8093e852eb8b1a2ebbb32478d6fb34cb651

All references

https://fluidattacks.com/advisories/alone
https://github.com/LimeSurvey/LimeSurvey
https://github.com/LimeSurvey/LimeSurvey/commit/c96db8093e852eb8b1a2ebbb32478d6fb34cb651
https://fluidattacks.com/advisories/alone

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-13533PoC
MEDIUMCVE-2025-14814
LOWCVE-2025-15677
MEDIUMCVE-2025-15696
LOWCVE-2025-15698
MEDIUMCVE-2025-36147
HIGHCVE-2025-61682PoC
MEDIUMCVE-2025-71419PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.