{"id":"CVE-2026-18403","summary":"LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB","details":"LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.","modified":"2026-08-16T03:48:28.866487050Z","published":"2026-08-14T18:33:31.017Z","database_specific":{"cna_assigner":"Fluid Attacks","cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18403.json"},"references":[{"type":"WEB","url":"https://github.com/LimeSurvey/LimeSurvey/"},{"type":"ADVISORY","url":"https://fluidattacks.com/es/advisories/rihanna"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18403.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18403"},{"type":"FIX","url":"https://github.com/LimeSurvey/LimeSurvey/commit/7735ce31cea1cad087b0c8556cb65a1c09e29cbd"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/limesurvey/limesurvey","events":[{"introduced":"ccc07bf9ae26313f3e2203eb5f7fe4ac8ed52d2c"},{"fixed":"7735ce31cea1cad087b0c8556cb65a1c09e29cbd"}],"database_specific":{"extracted_events":[{"introduced":"7.0.5"},{"last_affected":"7.0.5"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["7.0.5","7.0.9+260812","7.0.8+260806","7.0.7+260729","7.0.6+260722","7.0.5+260623"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18403.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}]}