ZeroDay Findings
Sign inSign up

Findings

CVE-2025-56422

A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.

Published Mar 10, 2026 · updated Jul 5, 2026 · limesurvey limesurvey

A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 10, 2026 · NIST NVD

    Detected

    A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.

  2. Jul 5, 2026 · NIST NVD

    Updated

    A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.

Affected

  • cpe limesurvey/limesurveyversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2025-56422

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2025-56422

    A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.

    nvd.nist.gov

References