Medium severity · published Jan 12, 2021
CVE-2020-26713
REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort
6.1
CVSS
1.2%
EPSS
No
On KEV
Description
REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login session information or borrow user rights to perform unauthorized acts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Redcap · Vanderbilt
10.0.20; 10.3.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-26713
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-26713
Exploit
https://github.com/vuongdq54/RedCap
Release Notes
https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
Product
https://www.project-redcap.org/
More from Redcap
9.8
CVE-2020-26712
REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter
9.0
CVE-2021-42136
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the…
8.8
CVE-2025-23113
An issue was discovered in REDCap 14.9.6
8.8
CVE-2024-56310
REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack
8.8
CVE-2024-56311
REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack