Description

CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid/<SID>/token/fwyfw%0d%0aCookie:%20POC'.

Remediation

References

CVE-2025-41376

Related Vulnerabilities

Contao Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-4335)

WordPress Plugin Page Builder by SiteOrigin Cross-Site Request Forgery (2.10.15)

MySQL CVE-2016-3440 Vulnerability (CVE-2016-3440)

WordPress Plugin SEO Redirection-301 Redirect Manager SQL Injection (8.1)

WordPress Plugin Registrations for the Events Calendar-Event Registration SQL Injection (2.7.5)

Severity

Medium

Classification

CVE-2025-41376 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities