Critical severity · published Jan 12, 2021
CVE-2020-26712
REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter
9.8
CVSS
2.1%
EPSS
No
On KEV
Description
REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information from the submitted user that is not validated well in the database query, resulting in an SQL injection vulnerability where an attacker can exploit and compromise all databases.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Redcap · Vanderbilt
10.0.20; 10.3.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-26712
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-26712
Exploit
https://github.com/vuongdq54/RedCap
Release Notes
https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
Product
https://www.project-redcap.org/
More from Redcap
9.0
CVE-2021-42136
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the…
8.8
CVE-2025-23113
An issue was discovered in REDCap 14.9.6
8.8
CVE-2024-56310
REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack
8.8
CVE-2024-56311
REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack
8.8
CVE-2017-7351
A SQL injection issue exists in a file upload handler in REDCap 7.x before 7.0.11 via a trailing substring to SendITController:upload