CVE-2025-41375 SQL Injection in Limesurvey

Critical 9.3 Published 1 Aug 2025 Updated 11 Sep 2025

Attackers can manipulate the token parameter to read, create, update, or delete database records in LimeSurvey.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-41375?

CVE-2025-41375 is a critical SQL injection vulnerability in Limesurvey Limesurvey, published on 1 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability allows an attacker to retrieve, create, update and delete database via 'token' parameter in '/index.php' endpoint.

Weakness: CWE-89

Which versions are affected by CVE-2025-41375?

It affects 1 product.

Products include Limesurvey Limesurvey.

How do I fix CVE-2025-41375?

No fix has been published for CVE-2025-41375 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2025-41375 being exploited?

There is no known exploitation of CVE-2025-41375 in the wild and no public exploit code.

All Limesurvey Limesurvey vulnerabilities

Sources

Also known as GHSA-7g68-w67q-848v.