LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php.
CWE-94 Improper Control of Generation of Code ('Code Injection')