CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Python 3 检查器（以及可配置的漏洞利用钩子），用于 CVE-2026-90817 （Securifera / Ryan Wincey）。 | ---|--- 产品| REDCap（Vanderbilt） 受影响版本| ≥ 13.3.0 （直至分支补丁） 已修复版本| 16.0.49 LTS、17.3.10 LTS、17.4.4 Standard+ CVSS 3.1| 9.8 严重 认证| 无 — 完整利用链需要有效的公开调查哈希 （s=） CWE|...

cve-2020-27358-27359

CVE-2020-27358 / CVE-2020-27359 CVE-2020-27358 および CVE-2020-27359 の悪用手順 CVE-2020-27358 REDCap 8.11.6 から 9.x までの 10 より前のバージョンで問題が見つかりました。メッセンジャーの CSV 機能（ユーザーが会話スレッドを CSV としてエクスポートできる機能）では、非特権ユーザーが、エンドポイント Messenger/messengerdownloadcsv.php?title=Hey&threadid=THREADID へのリクエスト内の threadid...

CVE-2024-55374

CVE-2024-55374 Redcap 14.3.13 は、ユーザーが存在するかどうかによって異なるエラーメッセージを返すため、ユーザー列挙の脆弱性があります。これにより、攻撃者は複数の HTTP 認証リクエストを送信してブルートフォース攻撃を実行できます。このベクターを軽減するための保護メカニズムが存在しますが、そのメカニズム自体が、攻撃者がアプリケーション内の有効なユーザーの存在を推測することを可能にします。...

CVE-2026-90817

CVE-2026-90817 — REDCap 调查透传 + 数据导入 RCE 针对 CVE-2026-90817 （Securifera / Ryan Wincey）的 Python 3 检查器（以及可配置的漏洞利用钩子）。 | ---|--- 产品| REDCap（Vanderbilt） 受影响版本| ≥ 13.3.0 （直至分支补丁） 修复版本| 16.0.49 LTS、17.3.10 LTS、17.4.4 Standard+ CVSS 3.1| 9.8 严重 认证| 无 — 完整利用链需要有效的公开调查哈希 （s=） CWE| CWE-73、CWE-94 概述 从公开调查...

CVE-2026-90817

CVE-2026-90817 — REDCap 未认证 RCE PoC（仅限授权使用） 仅限授权使用。 您需对每个目标的法律授权负责。未经授权对第三方 REDCap 实例使用属违法行为。 漏洞摘要 字段| 值 ---|--- CVE| CVE-2026-90817 产品| Vanderbilt University REDCap CVSS| 9.8 严重 认证| 未认证（需要有效的公开调查哈希） 受影响| REDCap 13.3.0 及更高版本 修复| 16.0.49 LTS、17.3.10 LTS、17.4.4 标准版 CWE|...

CVE-2026-90817

CVE-2026-90817 — REDCap 调查透传 + 数据导入 RCE 针对 CVE-2026-90817 （Securifera / Ryan Wincey）的 Python 3 检查器（以及可配置的漏洞利用钩子）。 | ---|--- 产品| REDCap（Vanderbilt） 受影响版本| ≥ 13.3.0 （直至分支补丁） 修复版本| 16.0.49 LTS、17.3.10 LTS、17.4.4 Standard+ CVSS 3.1| 9.8 严重 认证| 无 — 完整利用链需要有效的公开调查哈希 （s=） CWE| CWE-73、CWE-94 概述 从公开调查...

Exploit for CVE-2026-90817

CVE-2026-90817 — REDCap Unauthenticated RCE PoC Authorized Us...

Exploit for CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Pyt...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

EUVD-2026-83738

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

CVE-2026-90817 is an unauthenticated Remote Code Execution vulnerability in REDCap 13.3.0 and higher , rated CVSS 9.8 (Critical) . The flaw resides in the survey passthrough routing and Data Import processing logic , where an attacker can manipulate HTTP requests to reach an unintended controller...

PT-2026-95962

Name of the Vulnerable Software and Affected Versions REDCap versions 13.3.0 through 16.0.48 REDCap versions 17.0.0 through 17.3.9 REDCap versions 17.4.0 through 17.4.3 Description An unauthenticated remote code execution flaw exists in the survey passthrough routing and Data Import processing...

CVE-2026-90817: Improper Control of Generation of Code

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails

A China-linked espionage group hid inside North American medical, academic, and military research networks for more than a year, quietly stealing sensitive research and defense email. The way in was a backdoor on their REDCap research servers that stole login credentials. The exfiltration was the...

CVE-2025-23113

An issue was discovered in REDCap 14.9.6. It has an action=myprojects=1 CSRF issue in the alert-title while performing an upload of a CSV file containing a list of alert configuration. An attacker can send the victim a CSV file containing an HTML injection payload in the alert-title. Once the...

CVE-2022-42715

A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. A crafted CSV file will, when uploaded, trigger arbitrary JavaScript code execution...

CVE-2025-23111

An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacker can exploit this to trick the user that receives the survey into clicking on the field name, which redirects them to a phishing website...

CVE-2025-23112

An issue was discovered in REDCap 14.9.6. A stored cross-site scripting XSS vulnerability allows authenticated users to inject malicious scripts into the Survey field name of Survey. When a user receive the survey, if he clicks on the field name, it triggers the XSS payload...