CVE-2019-16184

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1236

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R46Patch, Release Notes, Third Party Advisory
https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-releasedRelease Notes, Vendor Advisory
https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R46Patch, Release Notes, Third Party Advisory
https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-releasedRelease Notes, Vendor Advisory

Timeline

Published: Sep 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-161857.2In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.CVE-2019-161867.2In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions.CVE-2019-161877.5Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-s CVE-2019-161887.1HCL AppScan Source before 9.03.13 is susceptible to XML External Entity (XXE) attacks in multiple locations. In particular, an attacker can CVE-2019-16199.8A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote att CVE-2019-161909.8SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 devices allows Authent CVE-2019-161929.8upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code throug CVE-2019-161935.4In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFIL CVE-2019-161949.8SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/mak CVE-2019-161956.1Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.CVE-2019-161976.1In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text betwee CVE-2019-161986.5KSLabs KSWEB 3.93 allows ../ directory traversal, as demonstrated by the hostFile parameter.