CVE-2024-55374

CVE-2024-55374 Redcap 14.3.13 は、ユーザーが存在するかどうかによって異なるエラーメッセージを返すため、ユーザー列挙の脆弱性があります。これにより、攻撃者は複数の HTTP 認証リクエストを送信してブルートフォース攻撃を実行できます。このベクターを軽減するための保護メカニズムが存在しますが、そのメカニズム自体が、攻撃者がアプリケーション内の有効なユーザーの存在を推測することを可能にします。...

CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE CVE-2026-90817 Securifera / Ryan Wincey 向けの Python 3 チェッカーおよび設定可能なエクスプロイトフック。 | ---|--- 製品| REDCap Vanderbilt 影響を受けるバージョン| ≥ 13.3.0 ブランチパッチまで 修正済み| 16.0.49 LTS、17.3.10 LTS、17.4.4 Standard+ CVSS 3.1| 9.8 Critical 認証| 不要 —...

CVE-2026-90817

CVE-2026-90817 — REDCap 未認証 RCE PoC 許可された使用のみ 許可された使用のみ。 すべてのターゲットに対する法的な許可については、あなたが責任を負います。第三者の REDCap インスタンスに対する未許可の使用は違法です。 脆弱性の概要 項目| 値 ---|--- CVE| CVE-2026-90817 製品| Vanderbilt University REDCap CVSS| 9.8 Critical 認証| 未認証 有効な公開アンケートハッシュが必要 影響を受けるバージョン| REDCap 13.3.0 以降 修正済み| 16.0.49...

CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE CVE-2026-90817 Securifera / Ryan Wincey 向けの Python 3 チェッカーおよび設定可能なエクスプロイトフック。 | ---|--- 製品| REDCap Vanderbilt 影響を受けるバージョン| ≥ 13.3.0ブランチパッチまで 修正済み| 16.0.49 LTS、17.3.10 LTS、17.4.4 Standard+ CVSS 3.1| 9.8 Critical 認証| 不要 —...

CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE CVE-2026-90817 Securifera / Ryan Wincey 向けの Python 3 チェッカーおよび設定可能なエクスプロイトフック。 | ---|--- 製品| REDCap Vanderbilt 影響を受けるバージョン| ≥ 13.3.0 ブランチパッチまで 修正済み| 16.0.49 LTS、17.3.10 LTS、17.4.4 Standard+ CVSS 3.1| 9.8 Critical 認証| なし —...

cve-2020-27358-27359

CVE-2020-27358 / CVE-2020-27359 CVE-2020-27358 および CVE-2020-27359 の悪用手順 CVE-2020-27358 REDCap 8.11.6 から 9.x までの 10 より前のバージョンで問題が見つかりました。メッセンジャーの CSV 機能（ユーザーが会話スレッドを CSV としてエクスポートできる機能）では、非特権ユーザーが、エンドポイント Messenger/messengerdownloadcsv.php?title=Hey&threadid=THREADID へのリクエスト内の threadid...

Exploit for CVE-2026-90817

CVE-2026-90817 — REDCap Unauthenticated RCE PoC Authorized Us...

Exploit for CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Pyt...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

CVE-2026-90817 is an unauthenticated Remote Code Execution vulnerability in REDCap 13.3.0 and higher , rated CVSS 9.8 (Critical) . The flaw resides in the survey passthrough routing and Data Import processing logic , where an attacker can manipulate HTTP requests to reach an unintended controller...

EUVD-2026-83738

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

PT-2026-95962

Name of the Vulnerable Software and Affected Versions REDCap versions 13.3.0 through 16.0.48 REDCap versions 17.0.0 through 17.3.9 REDCap versions 17.4.0 through 17.4.3 Description An unauthenticated remote code execution flaw exists in the survey passthrough routing and Data Import processing...

CVE-2026-90817: Improper Control of Generation of Code

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails

A China-linked espionage group hid inside North American medical, academic, and military research networks for more than a year, quietly stealing sensitive research and defense email. The way in was a backdoor on their REDCap research servers that stole login credentials. The exfiltration was the...

CVE-2025-23113

An issue was discovered in REDCap 14.9.6. It has an action=myprojects=1 CSRF issue in the alert-title while performing an upload of a CSV file containing a list of alert configuration. An attacker can send the victim a CSV file containing an HTML injection payload in the alert-title. Once the...

CVE-2022-42715

A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. A crafted CSV file will, when uploaded, trigger arbitrary JavaScript code execution...

CVE-2025-23111

An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacker can exploit this to trick the user that receives the survey into clicking on the field name, which redirects them to a phishing website...

CVE-2025-23112

An issue was discovered in REDCap 14.9.6. A stored cross-site scripting XSS vulnerability allows authenticated users to inject malicious scripts into the Survey field name of Survey. When a user receive the survey, if he clicks on the field name, it triggers the XSS payload...