What is GHSA-5w4g-f682-43cr?

GHSA-5w4g-f682-43cr is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey...

Which CVE IDs does GHSA-5w4g-f682-43cr cover?

GHSA-5w4g-f682-43cr covers the following CVE IDs: CVE-2018-10228. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5w4g-f682-43cr?

GHSA-5w4g-f682-43cr has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-5w4g-f682-43crMediumCVSS 6.1

Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey...

Vendor

GitHub Security Advisories

Published

December 15, 2021

Last Modified

July 5, 2026

🔗 CVE IDs covered (1)

CVE-2018-10228 →

📋 Description

Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web script or HTML via the changes_cp parameter to the index.php/admin/themes/sa/templatesavechanges URI.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-10228
http://limesurvey.com
https://github.com/LimeSurvey/LimeSurvey/blob/d0e0c94042fdb5119c9247dc2d57685334492e71/application/controllers/admin/themes.php#L644-L654
https://github.com/advisories/GHSA-5w4g-f682-43cr