PT-2025-47571 · Unknown+1 · Mysql Server+3

Published 2025-11-20 · Updated 2025-11-22 · CVE-2025-41076

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LimeSurvey version 6.13.0

Description A flaw exists that allows an external user to trigger a 500 error within the survey system by submitting a crafted session cookie. This results in the disclosure of internal backend details, including the use of the Yii framework and the MySQL/MariaDB database engine. Specifically, the table name lime sessions, primary keys, and portions of conflicting content are revealed. This information could aid an attacker in gathering data about the application's internal structure.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider implementing stricter input validation for session cookies to prevent the submission of malformed data.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BIT-LIMESURVEY-2025-41076

CVE-2025-41076

Affected Products

Limesurvey

Mariadb

Mysql Server

Yii Framework

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-41076 · Security Note
• https://osv.dev/vulnerability/CVE-2025-41076 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-limesurvey-2025-41076 · Vendor Advisory
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey-0 · Note
• https://t.me/cveNotify/143637 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1991563257723683318 · Twitter Post
• https://t.me/CVEtracker/37820 · Telegram Post