Read the docs
TI-2012-04165 Aliases CVE-2012-4927GHSA-8c2j-4fw8-5r95

SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224…

Priority LOW 37CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php.

Why it matters now

EPSS 0.02242 82nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*all versions; up to 1.90\+VulnerableLimeSurvey
cpe:2.3:a:limesurvey:limesurvey:1.5.2:*:*:*:*:*:*:*1.5.2VulnerableLimeSurvey
cpe:2.3:a:limesurvey:limesurvey:1.49:*:*:*:*:*:*:*1.49VulnerableLimeSurvey
cpe:2.3:a:limesurvey:limesurvey:1.49:rc2:*:*:*:*:*:*1.49 rc2VulnerableLimeSurvey
cpe:2.3:a:limesurvey:limesurvey:1.49_rc2:*:*:*:*:*:*:*1.49_rc2VulnerableLimeSurvey
cpe:2.3:a:limesurvey:limesurvey:1.52:*:*:*:*:*:*:*1.52VulnerableLimeSurvey
cpe:2.3:a:limesurvey:limesurvey:1.70:*:*:*:*:*:*:*1.70VulnerableLimeSurvey
cpe:2.3:a:limesurvey:limesurvey:1.80:*:*:*:*:*:*:*1.80VulnerableLimeSurvey
cpe:2.3:a:limesurvey:limesurvey:1.80:rc4:*:*:*:*:*:*1.80 rc4VulnerableLimeSurvey
cpe:2.3:a:limesurvey:limesurvey:1.80\+:*:*:*:*:*:*:*1.80+VulnerableLimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:* Versions all versions; up to 1.90\+ Vulnerable ·LimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·LimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:1.49:*:*:*:*:*:*:* Versions 1.49 Vulnerable ·LimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:1.49:rc2:*:*:*:*:*:* Versions 1.49 rc2 Vulnerable ·LimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:1.49_rc2:*:*:*:*:*:*:* Versions 1.49_rc2 Vulnerable ·LimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:1.52:*:*:*:*:*:*:* Versions 1.52 Vulnerable ·LimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:1.70:*:*:*:*:*:*:* Versions 1.70 Vulnerable ·LimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:1.80:*:*:*:*:*:*:* Versions 1.80 Vulnerable ·LimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:1.80:rc4:*:*:*:*:*:* Versions 1.80 rc4 Vulnerable ·LimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:1.80\+:*:*:*:*:*:*:* Versions 1.80+ Vulnerable ·LimeSurvey
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:limesurvey:limesurvey:1.81:*:*:*:*:*:*:*1.81VulnerableLimeSurvey
cpe:2.3:a:limesurvey:limesurvey:1.81\+:*:*:*:*:*:*:*1.81+VulnerableLimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:1.81:*:*:*:*:*:*:* Versions 1.81 Vulnerable ·LimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:1.81\+:*:*:*:*:*:*:* Versions 1.81+ Vulnerable ·LimeSurvey

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-4927
  2. 2026-10-03 Alias added: GHSA-8c2j-4fw8-5r95

References

Exploit 2

Other 3

  • TI-2020-09194 LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in… CVSS 3.1CRITICAL 9.8
  • TI-2024-28662 An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers… CVSS 3.1HIGH 8.8
  • TI-2024-26167 Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). CVSS 3.1HIGH 8.8
  • TI-2022-21122 LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the… CVSS 3.1HIGH 7.2
  • TI-2007-03523 Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor)… CVSS 2.0MEDIUM 6.8
  • TI-2018-12189 An issue was discovered in TCPDF before 6.2.22. CVSS 3.0CRITICAL 9.8
See all 81 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences