Miguel Gómez

An SQL injection issue exists in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global `surveys.create` permission can import a specially crafted .lsa archive. If the participant XML within this archive creates an attribute column with a malicious name, LimeSurvey passes this name to the Yii select builder during the response export process of a non-anonymous survey. Because names containing parentheses are processed as SQL expressions rather than quoted identifiers, this allows the execution of arbitrary SQL commands with the privileges of the application database.

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin.

LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participant id containing HTML. The import flow persists that value without model validation. When a CPDB editor opens the participant list, LimeSurvey derives ButtonGroupWidget id and name attributes from participant id and inserts them without HTML encoding, causing attacker-controlled markup to execute in the victim's authenticated LimeSurvey origin. Exploitation can access session-exposed data and issue same-origin requests with the victim's effective permissions.

A stored cross-site scripting issue exists in the friendship confirmation dialog. An authenticated low-privileged member can inject HTML into their first and last name fields. When another authenticated user views the profile and clicks the Friends option, the application uses the jQuery `html()` function to place the decoded display name into a modal, which executes the attacker-controlled markup within the user's session.

An authenticated user with global Surveys: create permissions can store a value that breaks JavaScript execution within the `date min` attribute of a Date/Time question. The issue occurs because the software inserts this stored value into a single-quoted inline JavaScript literal without applying proper JavaScript-context encoding, leading to stored Cross-Site Scripting (XSS), where malicious scripts are permanently stored on the server and executed in the browser of other users who render the affected question.

An authenticated user with permissions to create surveys can manipulate the REST survey-patching endpoint. While the system verifies the user's permission against the survey ID in the request URL, the persistence operations resolve target objects using global `qid` (question identifier) or `aid` (answer identifier) without verifying if these objects belong to the authorized survey. This allows a user to modify questions or answers belonging to another user's survey.

A reflected cross-site scripting issue exists on the administrative survey-participant CSV import result page. Reflected cross-site scripting occurs when an application includes untrusted data in a web page without proper validation or encoding, allowing an attacker to execute malicious scripts in the victim's browser.

A stored cross-site scripting (XSS) issue exists where a user with the delegated, non-system-administrator `admin manage users` permission can inject persistent HTML or JavaScript into a Profile Field Category title. Stored XSS occurs when a malicious script is permanently stored on the target server, which is then served to other users.

Cross-site Scripting (XSS) occurs in the administrative interface because the software fails to safely encode attacker-controlled content from a crafted `.lss` survey file when displaying import warnings.

An issue exists in the `index()` formula function where a low-privileged authenticated user with permissions to create or modify formula fields can provide an undocumented fourth argument. This argument is treated as a SQL template and interpolated directly into a PostgreSQL expression. The injected SQL is executed with the privileges of the Baserow PostgreSQL role during the recalculation of formula field values, bypassing the permissions of the authenticated application user.

An authenticated user possessing only the `settings:read` global permission can bypass authorization requirements to create new survey menu entries. This is achieved by directly invoking the POST '/index.php/admin/menuentries/sa/create' endpoint without the necessary `settings:update` privilege. Additionally, the endpoint allows the submission of menu IDs that are typically restricted to superadministrators, enabling unauthorized modifications to administrative navigation records.

An authenticated stored cross-site scripting issue exists in the replacement-fields dialog within the administrative question editor. Stored cross-site scripting occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way, allowing an attacker to execute malicious scripts in the browser of other users.

A stored cross-site scripting issue exists in the survey quota creation workflow. An authenticated user with low privileges who has permissions to create and manage surveys can inject and store malicious JavaScript within a quota message.

An authenticated reflected Cross-Site Scripting (XSS) issue exists in the user activation confirmation endpoint. The `action` query parameter is copied into the response and inserted into a hidden input attribute without proper HTML attribute encoding. Cross-Site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users.

An authenticated reflected cross-site scripting issue exists in the HTML editor popup endpoint. The `text` and `name` query parameters are processed using a blacklist sanitizer and subsequently rendered without context-appropriate output encoding. Cross-site scripting is a technique where malicious scripts are injected into trusted websites.