CVE-2014-5016: Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers...

Security readout for executives and security teams

CVE-2014-5016 describes multiple cross-site scripting flaws in LimeSurvey 2.05+ Build 140618. An attacker could inject script or HTML through specific participant, global settings, or CSV import paths. The sources do not provide CVSS, a confirmed affected-version range beyond the named build, or evidence of active exploitation. Exposure is most likely for organizations running LimeSurvey 2.05+ Build 140618, especially deployments with accessible admin, participant database, global settings, or CSV import workflows. Treat this as a moderate web-application risk if LimeSurvey is present. Prioritize internet-facing or externally administered instances, but avoid emergency escalation unless local exposure or exploitation evidence is found. Mitigation focus: Inventory LimeSurvey deployments and confirm exact version and build.; Review the LimeSurvey commit and vendor guidance for the appropriate fixed release.; Upgrade affected LimeSurvey installations when a vendor-supported fix is available..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.