CVE-2025-41076
Last modified
CVE-2025-41076 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the conflict. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the conflict. This information can simplify the collection of data about the internal architecture of the application by an attacker.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Limesurvey | Limesurvey | 6.13.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-41076?
How severe is CVE-2025-41076?
How do I fix CVE-2025-41076?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-41069Insecure Direct Object Reference (IDOR) vulnerability in Dep…5.3
- CVE-2025-4107Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2025-41070Reflected Cross-site Scripting (XSS) vulnerability in Sanoma…4.8
- CVE-2025-41073Path Traversal vulnerability in version 4.4.2236.1 of TESI G…6.5
- CVE-2025-41074Vulnerability in LimeSurvey 6.13.0 in the endpoint /optout …7.5
- CVE-2025-41075Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin th…7.5
- CVE-2025-41077IDOR vulnerability has been found in Viafirma Inbox v4.5.13 …8.1
- CVE-2025-41078Weaknesses in the authorization mechanisms of Viafirma Docum…8.1
- CVE-2025-41079A stored Cross-Site Scripting (XSS) vulnerability has been f…6.1
- CVE-2025-4108A vulnerability, which was classified as critical, was found…9.8
- CVE-2025-41080A stored Cross-Site Scripting (XSS) vulnerability has been f…6.1
- CVE-2025-41081Reflected Cross-Site Scripting (XSS) vulnerability in IsMyGy…5.1
Are you affected by CVE-2025-41076?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST