Vulnerabilities

TI-2025-14118 CVE-2025-15479 · GHSA-cc7j-j6fh-4xhc

NGSurvey Enterprise 3.6.4 incorrect authorization exposes other users’ API keys and personal data

LOW 23

Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms ( on Windows and Linux servers ) all…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00201 Published 2026-01-07 Fixed in 3.6.17 CWE-79

TI-2022-22970 CVE-2022-46485 · GHSA-2rmr-49w2-jxx7

Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable…

HIGH 72

Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Field" or "Contact Details".

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01257 Published 2023-08-02 No fix listed CWE-770

TI-2022-22969 CVE-2022-46484 · GHSA-5wmp-rj4f-wc26

Information disclosure in password protected surveys in Data Illusion Survey Software…

MEDIUM 40

Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbitrarily submit surveys.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00859 Published 2023-08-02 No fix listed CWE-922

Vulnerabilities

Filters

NGSurvey Enterprise 3.6.4 incorrect authorization exposes other users’ API keys and personal data

Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable…

Information disclosure in password protected surveys in Data Illusion Survey Software…