javahuang/SurveyKing

javahuang/SurveyKing

Releases3

Frequency2 months 1 day

Last Release over 4 years ago

Stars3.98K

One command to deploy a more powerful, self‑hosted alternative to SurveyMonkey.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2024-35049 ↗	May 14, 2024Tuesday, 14 May 2024, 15:39	9.1 CRITICAL	—
SurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022-25590.
CVE-2024-35050 ↗	May 14, 2024Tuesday, 14 May 2024, 15:39	8.8 HIGH	—
An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin.
CVE-2024-35048 ↗	May 14, 2024Tuesday, 14 May 2024, 15:39	4.3 MEDIUM	—
An issue in SurveyKing v1.3.1 allows attackers to execute a session replay attack after a user changes their password.
CVE-2022-25590 ↗	Mar 25, 2022Friday, 25 March 2022, 19:15	6.5 MEDIUM	4.3 MEDIUM
SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application.