Redcap
by Vanderbilt
CVEs (42)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-45527 | 0.00 | — | 0.00 | Sep 2, 2024 | REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via index.php?logout=1, and can also be used to insert a link to an external phishing website. | |||
| CVE-2023-38825 | 0.00 | — | 0.01 | Mar 6, 2024 | SQL injection vulnerability in Vanderbilt REDCap before v.13.8.0 allows a remote attacker to obtain sensitive information via the password reset mechanism in MyCapMobileApp/update.php. | |||
| CVE-2023-37798 | 0.00 | — | 0.00 | Sep 7, 2023 | A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.35 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the project title parameter. | |||
| CVE-2023-37361 | 0.00 | — | 0.01 | Jul 25, 2023 | REDCap 12.0.26 LTS and 12.3.2 Standard allows SQL Injection via scheduling, repeatforms, purpose, app_title, or randomization. | |||
| CVE-2022-42715 | 0.00 | — | 0.01 | Oct 12, 2022 | A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. A crafted CSV file will, when uploaded, trigger arbitrary JavaScript code execution. | |||
| CVE-2022-24127 | 0.00 | — | 0.01 | Jun 15, 2022 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php in REDCap 12.0.11. This issue allows any user with project management permissions to inject arbitrary code into the project title (app_title) field when editing an… | |||
| CVE-2022-24004 | 0.00 | — | 0.01 | Jun 15, 2022 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messenger_ajax.php in REDCap 12.0.11. This issue allows any authenticated user to inject arbitrary code into the messenger title (aka new_title) field when editing an existing conversation. The payload… | |||
| CVE-2020-26713 | 0.00 | — | 0.01 | Jan 12, 2021 | REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login… | |||
| CVE-2020-27359 | 0.00 | — | 0.01 | Oct 31, 2020 | A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user… | |||
| CVE-2020-27358 | 0.00 | — | 0.02 | Oct 31, 2020 | An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) allows non-privileged users to export one another's conversation threads by changing the thread_id parameter in the request… | |||
| CVE-2019-17121 | 0.00 | — | 0.01 | Oct 4, 2019 | REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values. | |||
| CVE-2019-15127 | 0.00 | — | 0.01 | Aug 21, 2019 | REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file. | |||
| CVE-2019-14937 | 0.00 | — | 0.01 | Aug 17, 2019 | REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to… | |||
| CVE-2013-4612 | 0.00 | — | 0.01 | Jun 17, 2013 | Multiple cross-site scripting (XSS) vulnerabilities in REDCap before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving different modules. | |||
| CVE-2013-4611 | 0.00 | — | 0.03 | Jun 17, 2013 | Multiple unspecified vulnerabilities in REDCap before 5.1.1 allow remote attackers to have an unknown impact via vectors involving (1) the Online Designer page or (2) the Manage Survey Participants page. | |||
| CVE-2013-4610 | 0.00 | — | 0.02 | Jun 17, 2013 | Unspecified vulnerability in the Data Search utility in data-entry forms in REDCap before 5.0.3 and 5.1.x before 5.1.2 has unknown impact and remote attack vectors. | |||
| CVE-2013-4609 | 0.00 | — | 0.02 | Jun 17, 2013 | REDCap before 5.0.4 and 5.1.x before 5.1.3 does not reject certain undocumented syntax within branching logic and calculations, which allows remote authenticated users to bypass intended access restrictions via (1) the Online Designer or (2) the Data Dictionary upload, as… | |||
| CVE-2013-4608 | 0.00 | — | 0.01 | Jun 17, 2013 | Cross-site scripting (XSS) vulnerability in REDCap before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via vectors involving the Graphical Data View & Descriptive Stats page. | |||
| CVE-2012-6567 | 0.00 | — | 0.01 | Jun 17, 2013 | REDCap before 4.14.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the logic of a custom rule. | |||
| CVE-2012-6566 | 0.00 | — | 0.01 | Jun 17, 2013 | Cross-site scripting (XSS) vulnerability in REDCap before 4.14.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
- CVE-2024-45527Sep 2, 2024risk 0.00cvss —epss 0.00
REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via index.php?logout=1, and can also be used to insert a link to an external phishing website.
- CVE-2023-38825Mar 6, 2024risk 0.00cvss —epss 0.01
SQL injection vulnerability in Vanderbilt REDCap before v.13.8.0 allows a remote attacker to obtain sensitive information via the password reset mechanism in MyCapMobileApp/update.php.
- CVE-2023-37798Sep 7, 2023risk 0.00cvss —epss 0.00
A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.35 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the project title parameter.
- CVE-2023-37361Jul 25, 2023risk 0.00cvss —epss 0.01
REDCap 12.0.26 LTS and 12.3.2 Standard allows SQL Injection via scheduling, repeatforms, purpose, app_title, or randomization.
- CVE-2022-42715Oct 12, 2022risk 0.00cvss —epss 0.01
A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. A crafted CSV file will, when uploaded, trigger arbitrary JavaScript code execution.
- CVE-2022-24127Jun 15, 2022risk 0.00cvss —epss 0.01
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php in REDCap 12.0.11. This issue allows any user with project management permissions to inject arbitrary code into the project title (app_title) field when editing an…
- CVE-2022-24004Jun 15, 2022risk 0.00cvss —epss 0.01
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messenger_ajax.php in REDCap 12.0.11. This issue allows any authenticated user to inject arbitrary code into the messenger title (aka new_title) field when editing an existing conversation. The payload…
- CVE-2020-26713Jan 12, 2021risk 0.00cvss —epss 0.01
REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login…
- CVE-2020-27359Oct 31, 2020risk 0.00cvss —epss 0.01
A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user…
- CVE-2020-27358Oct 31, 2020risk 0.00cvss —epss 0.02
An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) allows non-privileged users to export one another's conversation threads by changing the thread_id parameter in the request…
- CVE-2019-17121Oct 4, 2019risk 0.00cvss —epss 0.01
REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values.
- CVE-2019-15127Aug 21, 2019risk 0.00cvss —epss 0.01
REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file.
- CVE-2019-14937Aug 17, 2019risk 0.00cvss —epss 0.01
REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to…
- CVE-2013-4612Jun 17, 2013risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in REDCap before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving different modules.
- CVE-2013-4611Jun 17, 2013risk 0.00cvss —epss 0.03
Multiple unspecified vulnerabilities in REDCap before 5.1.1 allow remote attackers to have an unknown impact via vectors involving (1) the Online Designer page or (2) the Manage Survey Participants page.
- CVE-2013-4610Jun 17, 2013risk 0.00cvss —epss 0.02
Unspecified vulnerability in the Data Search utility in data-entry forms in REDCap before 5.0.3 and 5.1.x before 5.1.2 has unknown impact and remote attack vectors.
- CVE-2013-4609Jun 17, 2013risk 0.00cvss —epss 0.02
REDCap before 5.0.4 and 5.1.x before 5.1.3 does not reject certain undocumented syntax within branching logic and calculations, which allows remote authenticated users to bypass intended access restrictions via (1) the Online Designer or (2) the Data Dictionary upload, as…
- CVE-2013-4608Jun 17, 2013risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in REDCap before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via vectors involving the Graphical Data View & Descriptive Stats page.
- CVE-2012-6567Jun 17, 2013risk 0.00cvss —epss 0.01
REDCap before 4.14.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the logic of a custom rule.
- CVE-2012-6566Jun 17, 2013risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in REDCap before 4.14.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Page 2 of 3