Vanderbilt Redcap vulnerabilities

• vanderbilt redcap An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough... CVE-2026-90817 Public exploit 9.8 CriticalSeptember 20, 2026
• vanderbilt redcap REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between... CVE-2024-55374 Public exploit 5.3 MediumJanuary 2, 2026
• vanderbilt redcap A stored cross-site scripting (XSS) vulnerability in the Calendar function of REDCap 13.1.9... CVE-2024-37396 5.4 MediumJune 10, 2025
• vanderbilt redcap A stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9... CVE-2024-37395 5.4 MediumJune 10, 2025
• vanderbilt redcap A stored cross-site scripting (XSS) vulnerability in the Project Dashboards of REDCap 13.1.9... CVE-2024-37394 5.4 MediumJune 10, 2025
• vanderbilt redcap An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the... CVE-2025-23113 3.4 LowJanuary 10, 2025
• vanderbilt redcap An issue was discovered in REDCap 14.9.6. A stored cross-site scripting (XSS) vulnerability... CVE-2025-23112 6.1 MediumJanuary 10, 2025
• vanderbilt redcap An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name,... CVE-2025-23111 4.7 MediumJanuary 10, 2025
• vanderbilt redcap An issue was discovered in REDCap 14.9.6. A Reflected cross-site scripting (XSS) vulnerability in... CVE-2025-23110 6.1 MediumJanuary 10, 2025
• vanderbilt redcap A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows... CVE-2024-56377 5.4 MediumJanuary 9, 2025
• vanderbilt redcap A stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6... CVE-2024-56376 5.4 MediumJanuary 9, 2025
• vanderbilt redcap A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 15.0.0... CVE-2024-56314 5.4 MediumDecember 22, 2024
• vanderbilt redcap A stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 15.0... CVE-2024-56313 5.4 MediumDecember 22, 2024
• vanderbilt redcap A stored cross-site scripting (XSS) vulnerability in the Project Dashboard name of REDCap through... CVE-2024-56312 5.4 MediumDecember 22, 2024
• vanderbilt redcap REDCap through 15.0.0 has a security flaw in the Notes section of calendar events, exposing users... CVE-2024-56311 8.8 HighDecember 22, 2024
• vanderbilt redcap REDCap through 15.0.0 has a security flaw in the Project Dashboards name, exposing users to a... CVE-2024-56310 8.8 HighDecember 22, 2024
• redcap REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead... CVE-2024-45527 6.1 MediumSeptember 2, 2024
• vanderbilt redcap SQL injection vulnerability in Vanderbilt REDCap before v.13.8.0 allows a remote attacker to... CVE-2023-38825 6.5 MediumMarch 6, 2024
• vanderbilt redcap A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of... CVE-2023-37798 5.4 MediumSeptember 7, 2023
• vanderbilt redcap REDCap 12.0.26 LTS and 12.3.2 Standard allows SQL Injection via scheduling, repeatforms, purpose,... CVE-2023-37361 2.7 LowJuly 25, 2023
• vanderbilt redcap A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications... CVE-2022-42715 6.1 MediumOctober 12, 2022
• vanderbilt redcap A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral... CVE-2022-24127 5.4 MediumJune 15, 2022
• vanderbilt redcap A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messenger_ajax.php... CVE-2022-24004 5.4 MediumJune 15, 2022
• vanderbilt redcap A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes Functionality of... CVE-2021-42136 Public exploit 9.0 CriticalApril 13, 2022
• vanderbilt redcap REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The... CVE-2020-26713 6.1 MediumJanuary 12, 2021
• vanderbilt redcap REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter.... CVE-2020-26712 9.8 CriticalJanuary 12, 2021
• vanderbilt redcap An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that... CVE-2020-27358 Public exploit 4.3 MediumOctober 31, 2020
• vanderbilt redcap REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record... CVE-2019-17121 5.4 MediumOctober 4, 2019
• vanderbilt redcap REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool... CVE-2019-15127 5.4 MediumAugust 21, 2019
• vanderbilt redcap REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id... CVE-2019-14937 7.5 HighAugust 17, 2019
• vanderbilt redcap Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap... CVE-2019-13029 Public exploit 4.8 MediumJuly 11, 2019
• vanderbilt redcap A SQL injection issue exists in a file upload handler in REDCap 7.x before 7.0.11 via a trailing... CVE-2017-7351 8.8 HighFebruary 8, 2018
• vanderbilt redcap REDCap before 7.5.1 has XSS via the query string. CVE-2017-10962 6.1 MediumJuly 18, 2017
• vanderbilt redcap REDCap before 7.5.1 has CSRF in the deletion feature of the File Repository and File Upload... CVE-2017-10961 8.8 HighJuly 18, 2017
• project-redcap redcap Multiple cross-site scripting (XSS) vulnerabilities in REDCap before 5.1.0 allow remote attackers... CVE-2013-4612 4.3 MediumJune 17, 2013
• project-redcap redcap Multiple unspecified vulnerabilities in REDCap before 5.1.1 allow remote attackers to have an... CVE-2013-4611 10.0 HighJune 17, 2013
• project-redcap redcap Unspecified vulnerability in the Data Search utility in data-entry forms in REDCap before 5.0.3... CVE-2013-4610 10.0 HighJune 17, 2013
• project-redcap redcap REDCap before 5.0.4 and 5.1.x before 5.1.3 does not reject certain undocumented syntax within... CVE-2013-4609 6.5 MediumJune 17, 2013
• project-redcap redcap Cross-site scripting (XSS) vulnerability in REDCap before 5.0.6 allows remote attackers to inject... CVE-2013-4608 4.3 MediumJune 17, 2013
• vanderbilt redcap Cross-site scripting (XSS) vulnerability in REDCap before 4.14.2 allows remote attackers to... CVE-2012-6566 4.3 MediumJune 17, 2013
• vanderbilt redcap Cross-site scripting (XSS) vulnerability in REDCap before 4.14.3 allows remote authenticated... CVE-2012-6565 3.5 LowJune 17, 2013
• vanderbilt redcap Cross-site scripting (XSS) vulnerability in REDCap before 4.14.5 allows remote attackers to... CVE-2012-6564 4.3 MediumJune 17, 2013