CVE-2025-56421
Published: 10 March 2026
Summary
CVE-2025-56421 is a high-severity SQL Injection (CWE-89) vulnerability in Limesurvey Limesurvey. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-56421 is an SQL injection vulnerability (CWE-89) in LimeSurvey versions before 6.15.4+250710. This flaw affects the open-source survey application, enabling a remote attacker to obtain sensitive information from the database. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact accessible over the network with low complexity and no privileges or user interaction required.
A remote, unauthenticated attacker can exploit this vulnerability to extract sensitive data from the LimeSurvey database, such as survey responses or user details, by crafting and submitting malicious SQL inputs. The attack requires no special privileges and focuses solely on data disclosure, with no demonstrated impact on integrity or availability.
Advisories recommend upgrading to LimeSurvey version 6.15.4+250710 or later to mitigate the issue. Further details are available in the vendor notice at http://limesurvey.com and the security advisory at https://github.com/hongancalif/security-advisories/blob/main/CVE-2025-56421.md.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208502
Vulnerability details
SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing LimeSurvey web app directly enables remote exploitation for database data access (T1190: Exploit Public-Facing Application).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of flaws like this SQL injection vulnerability through vendor patches such as upgrading to LimeSurvey 6.15.4+250710.
Mandates information input validation and error handling at application entry points to reject or sanitize malicious SQL payloads, directly preventing SQL injection exploitation.
Boundary protection with web application firewalls or similar can inspect inbound traffic and block SQL injection attempts targeting the LimeSurvey application.