RE
Product
REDCap
41
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 6Medium 24Low 1
Watch
Add REDCap to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-38825 | 6.5 | Mar 21 | SQL injection vulnerability in Vanderbilt REDCap before v.13.8.0 allows a remote attacker to obtain sensitive information via the password reset mechanism in… Affected: before 13.8.0 |
| CVE-2025-23112 | 6.1 | Jan 10 | An issue was discovered in REDCap 14.9.6 Affected: 14.9.6 |
| CVE-2025-23110 | 6.1 | Jan 10 | An issue was discovered in REDCap 14.9.6 Affected: 14.9.6 |
| CVE-2025-23111 | 6.1 | Jan 10 | An issue was discovered in REDCap 14.9.6 Affected: 14.9.6 |
| CVE-2024-45527 | 6.1 | Sep 2 | REDCap 14.7.0 allows HTML injection via the project title of a New Project action Affected: 14.7.0 |
| CVE-2022-42715 | 6.1 | Oct 12 | A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature Affected: before 12.4.18; 12.5.0 before 12.5.11 |
| CVE-2020-26713 | 6.1 | Jan 12 | REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort Affected: 10.0.20; 10.3.4 |
| CVE-2017-10962 | 6.1 | Jul 18 | REDCap before 7.5.1 has XSS via the query string Affected: through 7.5.0 |
| CVE-2024-37395 | 5.4 | Jun 10 | A stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a… Affected: before 14.2.1 |
| CVE-2024-37396 | 5.4 | Jun 10 | A stored cross-site scripting (XSS) vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a… Affected: before 14.2.1 |
| CVE-2024-37394 | 5.4 | Jun 10 | A stored cross-site scripting (XSS) vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a… Affected: before 14.2.1 |
| CVE-2024-56377 | 5.4 | Jan 9 | A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the Survey Title field or Survey… Affected: 14.9.6 |
| CVE-2024-56376 | 5.4 | Jan 9 | A stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the message field Affected: 14.9.6 |
| CVE-2024-56313 | 5.4 | Dec 22 | A stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the Notes field of a… Affected: through 14.9.6 |
| CVE-2024-56314 | 5.4 | Dec 22 | A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the name field of a… Affected: through 14.9.6 |
| CVE-2024-56312 | 5.4 | Dec 22 | A stored cross-site scripting (XSS) vulnerability in the Project Dashboard name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the name field… Affected: through 14.9.6 |
| CVE-2023-37798 | 5.4 | Sep 7 | A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.35 allows attackers to execute arbitrary web scripts or… Affected: through 13.1.35 |
| CVE-2022-24127 | 5.4 | Jun 15 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php in REDCap 12.0.11 Affected: 12.0.11 |
| CVE-2022-24004 | 5.4 | Jun 15 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messenger_ajax.php in REDCap 12.0.11 Affected: 12.0.11 |
| CVE-2019-17121 | 5.4 | Oct 4 | REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values Affected: before 9.3.4 |
| CVE-2019-15127 | 5.4 | Aug 21 | REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file Affected: before 9.3.0 |
| CVE-2024-55374 | 5.3 | Jan 2 | REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts Affected: 14.3.13 |
| CVE-2019-13029 | 4.8 | Jul 11 | Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary… Affected: 8.0 before 8.10.2; 9.0 before 9.1.2 |
| CVE-2020-27358 | 4.3 | Nov 2 | An issue was discovered in REDCap 8.11.6 through 9.x before 10 Affected: 8.11.6 before 10.0 |
Showing 24