Ecosystem	Package	Version

Vulnerabilities

CVE-2025-41375

CVE-2025-41375

SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability allows an attacker to retrieve, create, update and delete database via 'token' parameter in '/index.php' endpoint.

Published Feb 2, 2026

https://osv-vulnerabilities.storage.googleapis.com/GIT/CVE-2025-41375.json https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey

CVSS ScoreCritical

9.8

Ecosystem	Package	Version

CVE-2025-41375 | Components Impacted | Sonatype Guide | Sonatype Guide


composer	limesurvey/limesurvey	2.65.2+170606
composer	limesurvey/limesurvey	2.65.3+170607
composer	limesurvey/limesurvey	2.65.4+170612
composer	limesurvey/limesurvey	2.65.5+170613
composer	limesurvey/limesurvey	2.65.6+170615
composer	limesurvey/limesurvey	2.66.6+170619
composer	limesurvey/limesurvey	2.67.0+170622
composer	limesurvey/limesurvey	2.67.1+170626
composer	limesurvey/limesurvey	2.67.2+170728
composer	limesurvey/limesurvey	2.67.3+170728
composer	limesurvey/limesurvey	2.70.0+170921
composer	limesurvey/limesurvey	2.71.0+170925
composer	limesurvey/limesurvey	2.71.1+170927
composer	limesurvey/limesurvey	2.72.0+171010
composer	limesurvey/limesurvey	2.72.1+171012
composer	limesurvey/limesurvey	2.72.2+171017
composer	limesurvey/limesurvey	2.72.3+171020
composer	limesurvey/limesurvey	2.72.4+171110
composer	limesurvey/limesurvey	2.72.5+171121
composer	limesurvey/limesurvey	2.72.6+171207
composer	limesurvey/limesurvey	2.73.0+171219
composer	limesurvey/limesurvey	2.73.1+171220
composer	limesurvey/limesurvey	3.0.0-beta.1+170720
composer	limesurvey/limesurvey	3.0.0-beta.2+170810
composer	limesurvey/limesurvey	3.0.0-beta.3+170914