LimeSurvey has a SQL Injection issue
The advisory, in context
The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which concatenates the values directly into a tid IN ('...') SQL clause without parameterization or input validation. A remote, authenticated attacker holding the tokens/update permission on a survey can inject a crafted array element to perform SQL injection. Because LimeSurvey configures its PDO connection with emulated prepared statements (emulatePrepare = true) and does not disable MySQL multi-statements, the injection supports stacked queries: the attacker can append arbitrary additional statements (INSERT/UPDATE/DELETE/DROP/CREATE) after the original SELECT. This permits both arbitrary read of any data in the database, such as administrator bcrypt password hashes (lime_users), survey response PII, session records, and global settings, all recoverable via a SLEEP() time-based blind oracle, and arbitrary write/destruction of that data, including directly overwriting the administrator password hash for immediate account takeover or dropping/truncating tables. Reads and writes extend to any schema the application's database user can access. The RemoteControl interface (RPCInterface = json/xml) must be enabled, which is not the default.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases through 7.0.0-beta1 (inclusive)
No fix recorded for this interval.
741 explicitly affected versions
1.0.4, 2.2.5, 2.65.2+170606, 2.65.3+170607, 2.65.4+170612, 2.65.5+170613, 2.65.6+170615, 2.66.6+170619, 2.67.0+170622, 2.67.1+170626, 2.67.2+170728, 2.67.3+170728, 2.70.0+170921, 2.71.0+170925, 2.71.1+170927, 2.72.0+171010, 2.72.1+171012, 2.72.2+171017, 2.72.3+171020, 2.72.4+171110, 2.72.5+171121, 2.72.6+171207, 2.73.0+171219, 2.73.1+171220, 3.0.0+171222, 3.0.0-RC.1, 3.0.0-RC.2+171102, 3.0.0-RC.3+171114, 3.0.0-beta.1+170720, 3.0.0-beta.2+170810, 3.0.0-beta.3+170914, 3.0.1+171228, 3.0.2+180110, 3.0.3+180112, 3.0.4+180116, 3.0.5+180118, 3.1.0, 3.1.1+180130, 3.10.0+180611, 3.11.0+180612, 3.12.0+180615, 3.12.1+180616, 3.12.2+180625, 3.12.3+180627, 3.13.0+180628, 3.13.1+180629, 3.13.2+180709, 3.14.0+180730, 3.14.1+180731, 3.14.10+180926, 3.14.11+180926, 3.14.2+180807, 3.14.4+180810, 3.14.5+180815, 3.14.6+180821, 3.14.7+180827, 3.14.8+180829, 3.14.9+180917, 3.15.0+181008, 3.15.1+181017, 3.15.2+181107, 3.15.3+181108, 3.15.4+181109, 3.15.5+181115, 3.15.6+190108, 3.15.7+190124, 3.15.8+190130, 3.15.9+190214, 3.16.1+190314, 3.17.0+190402, 3.17.1+190408, 3.17.10+190821, 3.17.11+190822, 3.17.12+190823, 3.17.13+190824, 3.17.14+190902, 3.17.15+190903, 3.17.16+190906, 3.17.17+190918, 3.17.3+190429, 3.17.4+190529, 3.17.5+190604, 3.17.6+190624, 3.17.7+190627, 3.17.8+190722, 3.17.9+190731, 3.18.0+190923, 3.19.0+191008, 3.19.1+191009, 3.19.2+191017, 3.19.3+191023, 3.2.0+180206, 3.2.1+180207, 3.20.0+191112, 3.20.1+191114, 3.20.2+191119, 3.21.0+191203, 3.21.1+191210, 3.21.2+191216, 3.21.3+191219, 3.21.4+200108, 3.21.5+200115, 3.21.6+200121, 3.22.0+200127, 3.22.1+200129, 3.22.10+200323, 3.22.11+200330, 3.22.12+200406, 3.22.13+200415, 3.22.14+200423, 3.22.15+200505, 3.22.16+200519, 3.22.17+200525, 3.22.18+200603, 3.22.19+200605, 3.22.2+200204, 3.22.20+200617, 3.22.21+200622, 3.22.210+200804, 3.22.22+200625, 3.22.23+200626, 3.22.24+200630, 3.22.25+200706, 3.22.26+200714, 3.22.27+200720, 3.22.28+200728, 3.22.29+200731, 3.22.3+200211, 3.22.4+200212, 3.22.5+200218, 3.22.6+200219, 3.22.7+200225, 3.22.8+200309, 3.22.9+200317, 3.23.0+200813, 3.23.1+200825, 3.23.2+200908, 3.23.3+200909, 3.23.4+200922, 3.23.5+200923, 3.23.6+200929, 3.23.7+201006, 3.24.0+201013, 3.24.1+201014, 3.24.2+201020, 3.24.3+201027, 3.24.4+201103, 3.24.5+201104, 3.24.6+201109, 3.25.0+201117, 3.25.1+201124, 3.25.10+210128, 3.25.11+210210, 3.25.12+210211, 3.25.13+210216, 3.25.14+210218, 3.25.15+210223, 3.25.16+210302, 3.25.17+210309, 3.25.18+210316, 3.25.19+210323, 3.25.2+201131, 3.25.20+210330, 3.25.21+210407, 3.25.22+210413, 3.25.3+201208, 3.25.4+201215, 3.25.5+201222, 3.25.6+201229, 3.25.7+210113, 3.25.8+210118, 3.25.9+210125, 3.26.0+210419, 3.26.1+210427, 3.26.2+210503, 3.26.3+210511, 3.26.4+210517, 3.26.5+210519, 3.27.0+210525, 3.27.1+210531, 3.27.10+210803, 3.27.11+210809, 3.27.12+210816, 3.27.13+210823, 3.27.14+210831, 3.27.15+210907, 3.27.16+210909, 3.27.17+210911, 3.27.18+210921, 3.27.19+210928, 3.27.2+210608, 3.27.20+211012, 3.27.21+211021, 3.27.22+211026, 3.27.23+211102, 3.27.24+211108, 3.27.25+211116, 3.27.26+211123, 3.27.27+211130, 3.27.28+211208, 3.27.29+211214, 3.27.3+210615, 3.27.30+211222, 3.27.31+220104, 3.27.32+220119, 3.27.33+220125, 3.27.34+220132, 3.27.35+220208, 3.27.4+210622, 3.27.5+210624, 3.27.6+210629, 3.27.7+210713, 3.27.8+210721, 3.27.9+210726, 3.28.1+220229, 3.28.10+220510, 3.28.11+220517, 3.28.12+220524, 3.28.13+220531, 3.28.14+220608, 3.28.15+220616, 3.28.16+220621, 3.28.17+220627, 3.28.18+220706, 3.28.19+220712, 3.28.2+220308, 3.28.20+220719, 3.28.21+220726, 3.28.22+220802, 3.28.23+220809, 3.28.24+220816, 3.28.25+220822, 3.28.26+220829, 3.28.27+220905, 3.28.28+220912, 3.28.29+220920, 3.28.3+220315, 3.28.30+220927, 3.28.31+221005, 3.28.32+221011, 3.28.33+221020, 3.28.34+221021, 3.28.35+221025, 3.28.36+221102, 3.28.37+221108, 3.28.38+221115, 3.28.39+221122, 3.28.4+220329, 3.28.40+221129, 3.28.41+221206, 3.28.42+221213, 3.28.43+221221, 3.28.44+230110, 3.28.45+230117, 3.28.46+230124, 3.28.47+230131, 3.28.48+230207, 3.28.49+230215, 3.28.5+220405, 3.28.50+230221, 3.28.51+230228, 3.28.52+230307, 3.28.53+230314, 3.28.54+230321, 3.28.55+230328, 3.28.56+230404, 3.28.57+230425, 3.28.58+230504, 3.28.59+230517, 3.28.6+220412, 3.28.60+230607, 3.28.61+230614, 3.28.62+230619, 3.28.63+230628, 3.28.64+230705, 3.28.65+230712, 3.28.66+230719, 3.28.67+230728, 3.28.69+230815, 3.28.7+220420, 3.28.71+230824, 3.28.72+230829, 3.28.73+230906, 3.28.74+230920, 3.28.75+231006, 3.28.76+231018, 3.28.8+220426, 3.28.9+220503, 3.29.0, 3.29.1, 3.29.2, 3.3.0+180209, 3.3.1, 3.4.0+180219, 3.4.1+180221, 3.4.2+180223, 3.4.3+180227, 3.4.4+180305, 3.5.0+180309, 3.5.1+180312, 3.5.2+180315, 3.5.3+180316, 3.5.4+180320, 3.6.0+180328, 3.6.1+180329, 3.6.2+180406, 3.6.3+180416, 3.7.0+180418, 3.7.1+180424, 3.7.2+180508, 3.7.3+180516, 3.8.0+180522, 3.8.1+180524, 3.8.2+180529, 3.9.0+180604, 4.0.0+200116, 4.0.0-RC10+191202, 4.0.0-RC11+191209, 4.0.0-RC12+191217, 4.0.0-RC13+191223, 4.0.0-RC14+200109, 4.0.0-RC2+190723, 4.0.0-RC3+190807, 4.0.0-RC4+190930, 4.0.0-RC5+191014, 4.0.0-RC6+191022, 4.0.0-RC7+191111, 4.0.0-RC8+191118, 4.0.0-RC9+191125, 4.0.0-alpha+181212, 4.0.0-beta, 4.0.1+200120, 4.1.0+200128, 4.1.1+200203, 4.1.10+200311, 4.1.11+200316, 4.1.12+200324, 4.1.13+200325, 4.1.14+200331, 4.1.15+200402, 4.1.16+200407, 4.1.17+200414, 4.1.18+200416, 4.1.2+200210, 4.1.3+200213, 4.1.4+200214, 4.1.5+200217, 4.1.6+200220, 4.1.7+200224, 4.1.8+200302, 4.1.9+200310, 4.2.0+200422, 4.2.1+200428, 4.2.2+200504, 4.2.3+200511, 4.2.4+200520, 4.2.5+200526, 4.2.6+200602, 4.2.7+200604, 4.2.8+200608, 4.3.0+200616, 4.3.1+200623, 4.3.10+200812, 4.3.11+200817, 4.3.12+200820, 4.3.13+200824, 4.3.14+200826, 4.3.15+200907, 4.3.16+200915, 4.3.17+200921, 4.3.18+200928, 4.3.19+201005, 4.3.2+200629, 4.3.20+201012, 4.3.21+201015, 4.3.22+201019, 4.3.23+201026, 4.3.24+201102, 4.3.25+201105, 4.3.26+201110, 4.3.27+201116, 4.3.28+201123, 4.3.29+201130, 4.3.3+200707, 4.3.30+201207, 4.3.31+201214, 4.3.32+201221, 4.3.33+201228, 4.3.34+210119, 4.3.4+200713, 4.3.5+200721, 4.3.6+200727, 4.3.7+200730, 4.3.8+200803, 4.3.9+200806, 4.4.0+210129, 4.4.0-RC1+201223, 4.4.0-RC2+210104, 4.4.0-RC3+210112, 4.4.1+210201, 4.4.10+210222, 4.4.11+210301, 4.4.12+210308, 4.4.13+210315, 4.4.14+210322, 4.4.15+210329, 4.4.16+210406, 4.4.2+210208, 4.4.3+210209, 4.4.4+210212, 4.4.5+210213, 4.4.6+210214, 4.4.7+210215, 4.4.8+210217, 4.4.9+210219, 4.5.0+210412, 4.5.1+210420, 4.5.2+210426, 4.6.0+210504, 4.6.1+210510, 4.6.2+210512, 4.6.3+210518, 5.0.0+210526, 5.0.1+210532, 5.0.10+210723, 5.0.11+210727, 5.0.12+210729, 5.0.13+210804, 5.0.2+210607, 5.0.3+210609, 5.0.4+210614, 5.0.5+210621, 5.0.6+210625, 5.0.7+210628, 5.0.8+210712, 5.0.9+210722, 5.1.0+210811, 5.1.1+210812, 5.1.10+210913, 5.1.11+210920, 5.1.12+210922, 5.1.13+210923, 5.1.14+210927, 5.1.15+211011, 5.1.16+211020, 5.1.17+211025, 5.1.18+211101, 5.1.2+210813, 5.1.3+210817, 5.1.4+210824, 5.1.5+210830, 5.1.6+210906, 5.1.7+210908, 5.1.8+210910, 5.1.9+210912, 5.2.0+211110, 5.2.1+211111, 5.2.10+220118, 5.2.11+220124, 5.2.12+220131, 5.2.13+220207, 5.2.14+220214, 5.2.2+211115, 5.2.3+211122, 5.2.4+211129, 5.2.5+211207, 5.2.6+211213, 5.2.7+211221, 5.2.8+220103, 5.2.9+220110, 5.3.0+220228, 5.3.1+220301, 5.3.10+220419, 5.3.11+220425, 5.3.12+220502, 5.3.13+220509, 5.3.14+220516, 5.3.15+220519, 5.3.16+220523, 5.3.17+220525, 5.3.18+220530, 5.3.19+220607, 5.3.2+220302, 5.3.20+220615, 5.3.21+220620, 5.3.22+220628, 5.3.23+220705, 5.3.24+220711, 5.3.25+220718, 5.3.26+220720, 5.3.27+220725, 5.3.28+220727, 5.3.29+220801, 5.3.3+220307, 5.3.30+220808, 5.3.31+220815, 5.3.32+220817, 5.3.4+220309, 5.3.5+220314, 5.3.6+220321, 5.3.7+220328, 5.3.8+220404, 5.3.9+220411, 5.4.0+220913, 5.4.1+220919, 5.4.10+221107, 5.4.11+221114, 5.4.12+221121, 5.4.13+221128, 5.4.14+221205, 5.4.15+221212, 5.4.2+220921, 5.4.3+220926, 5.4.4+221004, 5.4.5+221010, 5.4.6+221018, 5.4.7+221019, 5.4.8+221024, 5.4.9+221101, 5.5.0+221219, 5.5.1+230103, 5.5.2+230109, 5.6.0+230116, 5.6.1+230123, 5.6.10+230313, 5.6.11+230320, 5.6.12+230327, 5.6.13+230327, 5.6.14+230403, 5.6.15+230412, 5.6.16+230418, 5.6.17+230426, 5.6.18+230503, 5.6.19+230509, 5.6.2+230125, 5.6.20+230516, 5.6.21+230518, 5.6.22+230523, 5.6.23+230524, 5.6.24+230531, 5.6.25+230605, 5.6.26+230613, 5.6.27+230621, 5.6.28+230627, 5.6.29+230704, 5.6.3+230130, 5.6.30+230711, 5.6.31+230718, 5.6.32+230731, 5.6.33+230808, 5.6.34+230816, 5.6.35+230822, 5.6.36+230830, 5.6.37+230905, 5.6.38+230919, 5.6.39+230926, 5.6.4+230206, 5.6.40+231005, 5.6.41+231017, 5.6.42+231024, 5.6.43+231030, 5.6.44+231107, 5.6.45+231114, 5.6.46+231121, 5.6.47+231128, 5.6.48+231205, 5.6.49+231212, 5.6.5+230214, 5.6.50+240109, 5.6.51+240116, 5.6.52+240123, 5.6.53+240131, 5.6.54+240206, 5.6.55+240220, 5.6.56+240227, 5.6.57+240312, 5.6.58+240403, 5.6.59+240416, 5.6.6+230220, 5.6.60+240423, 5.6.61+240430, 5.6.62+240507, 5.6.63+240508, 5.6.64+240516, 5.6.65+240522, 5.6.66+240604, 5.6.67+240612, 5.6.68+240625, 5.6.7+230222, 5.6.8+230227, 5.6.9+230306, 6.0.0+230405, 6.0.1+230411, 6.0.2+230417, 6.0.3+230424, 6.0.4+230427, 6.0.5+230502, 6.0.6+230508, 6.0.7+230515, 6.1.0+230522, 6.1.1+230530, 6.1.2+230606, 6.1.3+230612, 6.1.4+230620, 6.1.5+230626, 6.1.6+230703, 6.1.7+230710, 6.1.8+230717, 6.10.0+250106, 6.10.1+250120, 6.10.2+250127, 6.10.3+250203, 6.10.4+250210, 6.10.5+250217, 6.10.6+250224, 6.11.0+250303, 6.12.0+250310, 6.12.1+250317, 6.12.2+250324, 6.12.3+250331, 6.12.4+250408, 6.13.0+250415, 6.13.1+250428, 6.13.2+250506, 6.13.3+250512, 6.14.0+250520, 6.14.1+250527, 6.14.2+250610, 6.14.3+250617, 6.15.0+250623, 6.15.1+250626, 6.15.10+250901, 6.15.11+250909, 6.15.12+250916, 6.15.13+250923, 6.15.14+250924, 6.15.15+250929, 6.15.16+251006, 6.15.17+251013, 6.15.18+251016, 6.15.19+251017, 6.15.2+250628, 6.15.20+251021, 6.15.21+251028, 6.15.22+251103, 6.15.23+251110, 6.15.24+251117, 6.15.3+250708, 6.15.4+250710, 6.15.5+250724, 6.15.6+250818, 6.15.7+250820, 6.15.8+250825, 6.15.9+250826, 6.16.0+251120, 6.16.1+251125, 6.16.10+260223, 6.16.11+260303, 6.16.12+260309, 6.16.13+260316, 6.16.14+260323, 6.16.15+260330, 6.16.16+260408, 6.16.17+260414, 6.16.2+251209, 6.16.3+251215, 6.16.4+260113, 6.16.5+260127, 6.16.6+260204, 6.16.7+260205, 6.16.8+260209, 6.16.9+260217, 6.17.0+260421, 6.2.0+230732, 6.2.1+230807, 6.2.10+231004, 6.2.11+231007, 6.2.2+230814, 6.2.3+230821, 6.2.4+230825, 6.2.5+230828, 6.2.6+230904, 6.2.7+230918, 6.2.8+230921, 6.2.9+230925, 6.3.0+231016, 6.3.1+231023, 6.3.2+231031, 6.3.3+231106, 6.3.4+231108, 6.3.5+231113, 6.3.6+231120, 6.3.7+231127, 6.3.8+231204, 6.3.9+231211, 6.4.0+231218, 6.4.1+240108, 6.4.10+240228, 6.4.11+240304, 6.4.12+240311, 6.4.2+240115, 6.4.3+240122, 6.4.4+240130, 6.4.5+240205, 6.4.6+240212, 6.4.7+240219, 6.4.8+240221, 6.4.9+240226, 6.5.0+240319, 6.5.1+240320, 6.5.10+240603, 6.5.11+240605, 6.5.12+240611, 6.5.13+240617, 6.5.14+240624, 6.5.15+240701, 6.5.16+240708, 6.5.17+240715, 6.5.18+240723, 6.5.2+240402, 6.5.3+240415, 6.5.4+240422, 6.5.5+240429, 6.5.6+240506, 6.5.7+240515, 6.5.8+240517, 6.5.9+240521, 6.6.0+240729, 6.6.1+240806, 6.6.2+240827, 6.6.3+240909, 6.6.4+240923, 6.6.5+240924, 6.6.6+241002, 6.6.7+241028, 6.6.8+241104, 6.7.0+241118, 6.8.0+241119, 6.8.1+241120, 6.8.2+241203, 6.9.0+241218
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.0.0-beta1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.4",
"2.2.5",
"2.65.2+170606",
"2.65.3+170607",
"2.65.4+170612",
"2.65.5+170613",
"2.65.6+170615",
"2.66.6+170619",
"2.67.0+170622",
"2.67.1+170626",
"2.67.2+170728",
"2.67.3+170728",
"2.70.0+170921",
"2.71.0+170925",
"2.71.1+170927",
"2.72.0+171010",
"2.72.1+171012",
"2.72.2+171017",
"2.72.3+171020",
"2.72.4+171110",
"2.72.5+171121",
"2.72.6+171207",
"2.73.0+171219",
"2.73.1+171220",
"3.0.0+171222",
"3.0.0-RC.1",
"3.0.0-RC.2+171102",
"3.0.0-RC.3+171114",
"3.0.0-beta.1+170720",
"3.0.0-beta.2+170810",
"3.0.0-beta.3+170914",
"3.0.1+171228",
"3.0.2+180110",
"3.0.3+180112",
"3.0.4+180116",
"3.0.5+180118",
"3.1.0",
"3.1.1+180130",
"3.10.0+180611",
"3.11.0+180612",
"3.12.0+180615",
"3.12.1+180616",
"3.12.2+180625",
"3.12.3+180627",
"3.13.0+180628",
"3.13.1+180629",
"3.13.2+180709",
"3.14.0+180730",
"3.14.1+180731",
"3.14.10+180926",
"3.14.11+180926",
"3.14.2+180807",
"3.14.4+180810",
"3.14.5+180815",
"3.14.6+180821",
"3.14.7+180827",
"3.14.8+180829",
"3.14.9+180917",
"3.15.0+181008",
"3.15.1+181017",
"3.15.2+181107",
"3.15.3+181108",
"3.15.4+181109",
"3.15.5+181115",
"3.15.6+190108",
"3.15.7+190124",
"3.15.8+190130",
"3.15.9+190214",
"3.16.1+190314",
"3.17.0+190402",
"3.17.1+190408",
"3.17.10+190821",
"3.17.11+190822",
"3.17.12+190823",
"3.17.13+190824",
"3.17.14+190902",
"3.17.15+190903",
"3.17.16+190906",
"3.17.17+190918",
"3.17.3+190429",
"3.17.4+190529",
"3.17.5+190604",
"3.17.6+190624",
"3.17.7+190627",
"3.17.8+190722",
"3.17.9+190731",
"3.18.0+190923",
"3.19.0+191008",
"3.19.1+191009",
"3.19.2+191017",
"3.19.3+191023",
"3.2.0+180206",
"3.2.1+180207",
"3.20.0+191112",
"3.20.1+191114",
"3.20.2+191119",
"3.21.0+191203",
"3.21.1+191210",
"3.21.2+191216",
"3.21.3+191219",
"3.21.4+200108",
"3.21.5+200115",
"3.21.6+200121",
"3.22.0+200127",
"3.22.1+200129",
"3.22.10+200323",
"3.22.11+200330",
"3.22.12+200406",
"3.22.13+200415",
"3.22.14+200423",
"3.22.15+200505",
"3.22.16+200519",
"3.22.17+200525",
"3.22.18+200603",
"3.22.19+200605",
"3.22.2+200204",
"3.22.20+200617",
"3.22.21+200622",
"3.22.210+200804",
"3.22.22+200625",
"3.22.23+200626",
"3.22.24+200630",
"3.22.25+200706",
"3.22.26+200714",
"3.22.27+200720",
"3.22.28+200728",
"3.22.29+200731",
"3.22.3+200211",
"3.22.4+200212",
"3.22.5+200218",
"3.22.6+200219",
"3.22.7+200225",
"3.22.8+200309",
"3.22.9+200317",
"3.23.0+200813",
"3.23.1+200825",
"3.23.2+200908",
"3.23.3+200909",
"3.23.4+200922",
"3.23.5+200923",
"3.23.6+200929",
"3.23.7+201006",
"3.24.0+201013",
"3.24.1+201014",
"3.24.2+201020",
"3.24.3+201027",
"3.24.4+201103",
"3.24.5+201104",
"3.24.6+201109",
"3.25.0+201117",
"3.25.1+201124",
"3.25.10+210128",
"3.25.11+210210",
"3.25.12+210211",
"3.25.13+210216",
"3.25.14+210218",
"3.25.15+210223",
"3.25.16+210302",
"3.25.17+210309",
"3.25.18+210316",
"3.25.19+210323",
"3.25.2+201131",
"3.25.20+210330",
"3.25.21+210407",
"3.25.22+210413",
"3.25.3+201208",
"3.25.4+201215",
"3.25.5+201222",
"3.25.6+201229",
"3.25.7+210113",
"3.25.8+210118",
"3.25.9+210125",
"3.26.0+210419",
"3.26.1+210427",
"3.26.2+210503",
"3.26.3+210511",
"3.26.4+210517",
"3.26.5+210519",
"3.27.0+210525",
"3.27.1+210531",
"3.27.10+210803",
"3.27.11+210809",
"3.27.12+210816",
"3.27.13+210823",
"3.27.14+210831",
"3.27.15+210907",
"3.27.16+210909",
"3.27.17+210911",
"3.27.18+210921",
"3.27.19+210928",
"3.27.2+210608",
"3.27.20+211012",
"3.27.21+211021",
"3.27.22+211026",
"3.27.23+211102",
"3.27.24+211108",
"3.27.25+211116",
"3.27.26+211123",
"3.27.27+211130",
"3.27.28+211208",
"3.27.29+211214",
"3.27.3+210615",
"3.27.30+211222",
"3.27.31+220104",
"3.27.32+220119",
"3.27.33+220125",
"3.27.34+220132",
"3.27.35+220208",
"3.27.4+210622",
"3.27.5+210624",
"3.27.6+210629",
"3.27.7+210713",
"3.27.8+210721",
"3.27.9+210726",
"3.28.1+220229",
"3.28.10+220510",
"3.28.11+220517",
"3.28.12+220524",
"3.28.13+220531",
"3.28.14+220608",
"3.28.15+220616",
"3.28.16+220621",
"3.28.17+220627",
"3.28.18+220706",
"3.28.19+220712",
"3.28.2+220308",
"3.28.20+220719",
"3.28.21+220726",
"3.28.22+220802",
"3.28.23+220809",
"3.28.24+220816",
"3.28.25+220822",
"3.28.26+220829",
"3.28.27+220905",
"3.28.28+220912",
"3.28.29+220920",
"3.28.3+220315",
"3.28.30+220927",
"3.28.31+221005",
"3.28.32+221011",
"3.28.33+221020",
"3.28.34+221021",
"3.28.35+221025",
"3.28.36+221102",
"3.28.37+221108",
"3.28.38+221115",
"3.28.39+221122",
"3.28.4+220329",
"3.28.40+221129",
"3.28.41+221206",
"3.28.42+221213",
"3.28.43+221221",
"3.28.44+230110",
"3.28.45+230117",
"3.28.46+230124",
"3.28.47+230131",
"3.28.48+230207",
"3.28.49+230215",
"3.28.5+220405",
"3.28.50+230221",
"3.28.51+230228",
"3.28.52+230307",
"3.28.53+230314",
"3.28.54+230321",
"3.28.55+230328",
"3.28.56+230404",
"3.28.57+230425",
"3.28.58+230504",
"3.28.59+230517",
"3.28.6+220412",
"3.28.60+230607",
"3.28.61+230614",
"3.28.62+230619",
"3.28.63+230628",
"3.28.64+230705",
"3.28.65+230712",
"3.28.66+230719",
"3.28.67+230728",
"3.28.69+230815",
"3.28.7+220420",
"3.28.71+230824",
"3.28.72+230829",
"3.28.73+230906",
"3.28.74+230920",
"3.28.75+231006",
"3.28.76+231018",
"3.28.8+220426",
"3.28.9+220503",
"3.29.0",
"3.29.1",
"3.29.2",
"3.3.0+180209",
"3.3.1",
"3.4.0+180219",
"3.4.1+180221",
"3.4.2+180223",
"3.4.3+180227",
"3.4.4+180305",
"3.5.0+180309",
"3.5.1+180312",
"3.5.2+180315",
"3.5.3+180316",
"3.5.4+180320",
"3.6.0+180328",
"3.6.1+180329",
"3.6.2+180406",
"3.6.3+180416",
"3.7.0+180418",
"3.7.1+180424",
"3.7.2+180508",
"3.7.3+180516",
"3.8.0+180522",
"3.8.1+180524",
"3.8.2+180529",
"3.9.0+180604",
"4.0.0+200116",
"4.0.0-RC10+191202",
"4.0.0-RC11+191209",
"4.0.0-RC12+191217",
"4.0.0-RC13+191223",
"4.0.0-RC14+200109",
"4.0.0-RC2+190723",
"4.0.0-RC3+190807",
"4.0.0-RC4+190930",
"4.0.0-RC5+191014",
"4.0.0-RC6+191022",
"4.0.0-RC7+191111",
"4.0.0-RC8+191118",
"4.0.0-RC9+191125",
"4.0.0-alpha+181212",
"4.0.0-beta",
"4.0.1+200120",
"4.1.0+200128",
"4.1.1+200203",
"4.1.10+200311",
"4.1.11+200316",
"4.1.12+200324",
"4.1.13+200325",
"4.1.14+200331",
"4.1.15+200402",
"4.1.16+200407",
"4.1.17+200414",
"4.1.18+200416",
"4.1.2+200210",
"4.1.3+200213",
"4.1.4+200214",
"4.1.5+200217",
"4.1.6+200220",
"4.1.7+200224",
"4.1.8+200302",
"4.1.9+200310",
"4.2.0+200422",
"4.2.1+200428",
"4.2.2+200504",
"4.2.3+200511",
"4.2.4+200520",
"4.2.5+200526",
"4.2.6+200602",
"4.2.7+200604",
"4.2.8+200608",
"4.3.0+200616",
"4.3.1+200623",
"4.3.10+200812",
"4.3.11+200817",
"4.3.12+200820",
"4.3.13+200824",
"4.3.14+200826",
"4.3.15+200907",
"4.3.16+200915",
"4.3.17+200921",
"4.3.18+200928",
"4.3.19+201005",
"4.3.2+200629",
"4.3.20+201012",
"4.3.21+201015",
"4.3.22+201019",
"4.3.23+201026",
"4.3.24+201102",
"4.3.25+201105",
"4.3.26+201110",
"4.3.27+201116",
"4.3.28+201123",
"4.3.29+201130",
"4.3.3+200707",
"4.3.30+201207",
"4.3.31+201214",
"4.3.32+201221",
"4.3.33+201228",
"4.3.34+210119",
"4.3.4+200713",
"4.3.5+200721",
"4.3.6+200727",
"4.3.7+200730",
"4.3.8+200803",
"4.3.9+200806",
"4.4.0+210129",
"4.4.0-RC1+201223",
"4.4.0-RC2+210104",
"4.4.0-RC3+210112",
"4.4.1+210201",
"4.4.10+210222",
"4.4.11+210301",
"4.4.12+210308",
"4.4.13+210315",
"4.4.14+210322",
"4.4.15+210329",
"4.4.16+210406",
"4.4.2+210208",
"4.4.3+210209",
"4.4.4+210212",
"4.4.5+210213",
"4.4.6+210214",
"4.4.7+210215",
"4.4.8+210217",
"4.4.9+210219",
"4.5.0+210412",
"4.5.1+210420",
"4.5.2+210426",
"4.6.0+210504",
"4.6.1+210510",
"4.6.2+210512",
"4.6.3+210518",
"5.0.0+210526",
"5.0.1+210532",
"5.0.10+210723",
"5.0.11+210727",
"5.0.12+210729",
"5.0.13+210804",
"5.0.2+210607",
"5.0.3+210609",
"5.0.4+210614",
"5.0.5+210621",
"5.0.6+210625",
"5.0.7+210628",
"5.0.8+210712",
"5.0.9+210722",
"5.1.0+210811",
"5.1.1+210812",
"5.1.10+210913",
"5.1.11+210920",
"5.1.12+210922",
"5.1.13+210923",
"5.1.14+210927",
"5.1.15+211011",
"5.1.16+211020",
"5.1.17+211025",
"5.1.18+211101",
"5.1.2+210813",
"5.1.3+210817",
"5.1.4+210824",
"5.1.5+210830",
"5.1.6+210906",
"5.1.7+210908",
"5.1.8+210910",
"5.1.9+210912",
"5.2.0+211110",
"5.2.1+211111",
"5.2.10+220118",
"5.2.11+220124",
"5.2.12+220131",
"5.2.13+220207",
"5.2.14+220214",
"5.2.2+211115",
"5.2.3+211122",
"5.2.4+211129",
"5.2.5+211207",
"5.2.6+211213",
"5.2.7+211221",
"5.2.8+220103",
"5.2.9+220110",
"5.3.0+220228",
"5.3.1+220301",
"5.3.10+220419",
"5.3.11+220425",
"5.3.12+220502",
"5.3.13+220509",
"5.3.14+220516",
"5.3.15+220519",
"5.3.16+220523",
"5.3.17+220525",
"5.3.18+220530",
"5.3.19+220607",
"5.3.2+220302",
"5.3.20+220615",
"5.3.21+220620",
"5.3.22+220628",
"5.3.23+220705",
"5.3.24+220711",
"5.3.25+220718",
"5.3.26+220720",
"5.3.27+220725",
"5.3.28+220727",
"5.3.29+220801",
"5.3.3+220307",
"5.3.30+220808",
"5.3.31+220815",
"5.3.32+220817",
"5.3.4+220309",
"5.3.5+220314",
"5.3.6+220321",
"5.3.7+220328",
"5.3.8+220404",
"5.3.9+220411",
"5.4.0+220913",
"5.4.1+220919",
"5.4.10+221107",
"5.4.11+221114",
"5.4.12+221121",
"5.4.13+221128",
"5.4.14+221205",
"5.4.15+221212",
"5.4.2+220921",
"5.4.3+220926",
"5.4.4+221004",
"5.4.5+221010",
"5.4.6+221018",
"5.4.7+221019",
"5.4.8+221024",
"5.4.9+221101",
"5.5.0+221219",
"5.5.1+230103",
"5.5.2+230109",
"5.6.0+230116",
"5.6.1+230123",
"5.6.10+230313",
"5.6.11+230320",
"5.6.12+230327",
"5.6.13+230327",
"5.6.14+230403",
"5.6.15+230412",
"5.6.16+230418",
"5.6.17+230426",
"5.6.18+230503",
"5.6.19+230509",
"5.6.2+230125",
"5.6.20+230516",
"5.6.21+230518",
"5.6.22+230523",
"5.6.23+230524",
"5.6.24+230531",
"5.6.25+230605",
"5.6.26+230613",
"5.6.27+230621",
"5.6.28+230627",
"5.6.29+230704",
"5.6.3+230130",
"5.6.30+230711",
"5.6.31+230718",
"5.6.32+230731",
"5.6.33+230808",
"5.6.34+230816",
"5.6.35+230822",
"5.6.36+230830",
"5.6.37+230905",
"5.6.38+230919",
"5.6.39+230926",
"5.6.4+230206",
"5.6.40+231005",
"5.6.41+231017",
"5.6.42+231024",
"5.6.43+231030",
"5.6.44+231107",
"5.6.45+231114",
"5.6.46+231121",
"5.6.47+231128",
"5.6.48+231205",
"5.6.49+231212",
"5.6.5+230214",
"5.6.50+240109",
"5.6.51+240116",
"5.6.52+240123",
"5.6.53+240131",
"5.6.54+240206",
"5.6.55+240220",
"5.6.56+240227",
"5.6.57+240312",
"5.6.58+240403",
"5.6.59+240416",
"5.6.6+230220",
"5.6.60+240423",
"5.6.61+240430",
"5.6.62+240507",
"5.6.63+240508",
"5.6.64+240516",
"5.6.65+240522",
"5.6.66+240604",
"5.6.67+240612",
"5.6.68+240625",
"5.6.7+230222",
"5.6.8+230227",
"5.6.9+230306",
"6.0.0+230405",
"6.0.1+230411",
"6.0.2+230417",
"6.0.3+230424",
"6.0.4+230427",
"6.0.5+230502",
"6.0.6+230508",
"6.0.7+230515",
"6.1.0+230522",
"6.1.1+230530",
"6.1.2+230606",
"6.1.3+230612",
"6.1.4+230620",
"6.1.5+230626",
"6.1.6+230703",
"6.1.7+230710",
"6.1.8+230717",
"6.10.0+250106",
"6.10.1+250120",
"6.10.2+250127",
"6.10.3+250203",
"6.10.4+250210",
"6.10.5+250217",
"6.10.6+250224",
"6.11.0+250303",
"6.12.0+250310",
"6.12.1+250317",
"6.12.2+250324",
"6.12.3+250331",
"6.12.4+250408",
"6.13.0+250415",
"6.13.1+250428",
"6.13.2+250506",
"6.13.3+250512",
"6.14.0+250520",
"6.14.1+250527",
"6.14.2+250610",
"6.14.3+250617",
"6.15.0+250623",
"6.15.1+250626",
"6.15.10+250901",
"6.15.11+250909",
"6.15.12+250916",
"6.15.13+250923",
"6.15.14+250924",
"6.15.15+250929",
"6.15.16+251006",
"6.15.17+251013",
"6.15.18+251016",
"6.15.19+251017",
"6.15.2+250628",
"6.15.20+251021",
"6.15.21+251028",
"6.15.22+251103",
"6.15.23+251110",
"6.15.24+251117",
"6.15.3+250708",
"6.15.4+250710",
"6.15.5+250724",
"6.15.6+250818",
"6.15.7+250820",
"6.15.8+250825",
"6.15.9+250826",
"6.16.0+251120",
"6.16.1+251125",
"6.16.10+260223",
"6.16.11+260303",
"6.16.12+260309",
"6.16.13+260316",
"6.16.14+260323",
"6.16.15+260330",
"6.16.16+260408",
"6.16.17+260414",
"6.16.2+251209",
"6.16.3+251215",
"6.16.4+260113",
"6.16.5+260127",
"6.16.6+260204",
"6.16.7+260205",
"6.16.8+260209",
"6.16.9+260217",
"6.17.0+260421",
"6.2.0+230732",
"6.2.1+230807",
"6.2.10+231004",
"6.2.11+231007",
"6.2.2+230814",
"6.2.3+230821",
"6.2.4+230825",
"6.2.5+230828",
"6.2.6+230904",
"6.2.7+230918",
"6.2.8+230921",
"6.2.9+230925",
"6.3.0+231016",
"6.3.1+231023",
"6.3.2+231031",
"6.3.3+231106",
"6.3.4+231108",
"6.3.5+231113",
"6.3.6+231120",
"6.3.7+231127",
"6.3.8+231204",
"6.3.9+231211",
"6.4.0+231218",
"6.4.1+240108",
"6.4.10+240228",
"6.4.11+240304",
"6.4.12+240311",
"6.4.2+240115",
"6.4.3+240122",
"6.4.4+240130",
"6.4.5+240205",
"6.4.6+240212",
"6.4.7+240219",
"6.4.8+240221",
"6.4.9+240226",
"6.5.0+240319",
"6.5.1+240320",
"6.5.10+240603",
"6.5.11+240605",
"6.5.12+240611",
"6.5.13+240617",
"6.5.14+240624",
"6.5.15+240701",
"6.5.16+240708",
"6.5.17+240715",
"6.5.18+240723",
"6.5.2+240402",
"6.5.3+240415",
"6.5.4+240422",
"6.5.5+240429",
"6.5.6+240506",
"6.5.7+240515",
"6.5.8+240517",
"6.5.9+240521",
"6.6.0+240729",
"6.6.1+240806",
"6.6.2+240827",
"6.6.3+240909",
"6.6.4+240923",
"6.6.5+240924",
"6.6.6+241002",
"6.6.7+241028",
"6.6.8+241104",
"6.7.0+241118",
"6.8.0+241119",
"6.8.1+241120",
"6.8.2+241203",
"6.9.0+241218"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2026-50636
- https://github.com/LimeSurvey/LimeSurvey/pull/5031
- https://github.com/LimeSurvey/LimeSurvey/commit/4f383aa0bbe711f0064b319edb19fba759c50a33
- https://github.com/LimeSurvey/LimeSurvey/commit/98cfee55df97f9c82a72cf352bb204d51e588f7e
- https://github.com/LimeSurvey/LimeSurvey
- https://www.limesurvey.org
- https://www.vulncheck.com/advisories/limesurvey-remotecontrol-invite-participants-remind-participants-sql-injection