CVE-2025-63238 | LimeSurvey up to 6.15.11 URL QuestionCreate.php getInstance gid cross site scripting

A vulnerability was found in LimeSurvey up to 6.15.11 and classified as problematic. The affected element is the function getInstance of the file application/models/QuestionCreate.php of the component URL Handler. Executing a manipulation of the argument gid can lead to cross site scripting.

This vulnerability is handled as CVE-2025-63238. The attack can be executed remotely. There is not any exploit available.

A patch should be applied to remediate this issue.