CVE-2025-63238

Name of the Vulnerable Software and Affected Versions LimeSurvey versions prior to 6.15.11+250909

Description Reflected Cross-Site Scripting (XSS) occurs due to insufficient validation of the gid parameter within the getInstance() function located in application/models/QuestionCreate.php. This flaw allows an attacker to use a specially crafted URL to execute malicious scripts in the context of a logged-in user's session.

Recommendations Update to version 6.15.11+250909 or later. As a temporary mitigation, restrict access to the getInstance() function in application/models/QuestionCreate.php.