Miguel Gómez

**Name of the Vulnerable Software and Affected Versions** Baserow version 2.3.3 **Description** An issue exists in the `index()` formula function where a low-privileged authenticated user with permissions to create or modify formula fields can provide an undocumented fourth argument. This argument is treated as a SQL template and interpolated directly into a PostgreSQL expression. The injected SQL is executed with the privileges of the Baserow PostgreSQL role during the recalculation of formula field values, bypassing the permissions of the authenticated application user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LimeSurvey Community Edition version 7.0.5 **Description** An authenticated user possessing only the `settings:read` global permission can bypass authorization requirements to create new survey menu entries. This is achieved by directly invoking the POST '/index.php/admin/menuentries/sa/create' endpoint without the necessary `settings:update` privilege. Additionally, the endpoint allows the submission of menu IDs that are typically restricted to superadministrators, enabling unauthorized modifications to administrative navigation records. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LimeSurvey Community Edition version 7.0.5 **Description** A stored cross-site scripting issue exists in the survey quota creation workflow. An authenticated user with low privileges who has permissions to create and manage surveys can inject and store malicious JavaScript within a quota message. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LimeSurvey Community Edition version 7.0.5 **Description** An authenticated reflected Cross-Site Scripting (XSS) issue exists in the user activation confirmation endpoint. The `action` query parameter is copied into the response and inserted into a hidden input attribute without proper HTML attribute encoding. Cross-Site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LimeSurvey Community Edition version 7.0.5 **Description** An authenticated stored cross-site scripting issue exists in the replacement-fields dialog within the administrative question editor. Stored cross-site scripting occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way, allowing an attacker to execute malicious scripts in the browser of other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LimeSurvey Community Edition version 7.0.5 **Description** An authenticated reflected cross-site scripting issue exists in the HTML editor popup endpoint. The `text` and `name` query parameters are processed using a blacklist sanitizer and subsequently rendered without context-appropriate output encoding. Cross-site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** Update LimeSurvey Community Edition to a version newer than 7.0.5. As a temporary mitigation, restrict access to the HTML editor popup endpoint.