CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Python 3 checker and configurable exploit hook for CVE-2026-90817 Securifera / Ryan Wincey. | ---|--- Product| REDCap Vanderbilt Affected| ≥ 13.3.0 until branch patch Fixed| 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard+ CVSS 3.1| 9.8 Critical...

CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Python 3 checker and configurable exploit hook for CVE-2026-90817 Securifera / Ryan Wincey. | ---|--- Product| REDCap Vanderbilt Affected| ≥ 13.3.0 until branch patch Fixed| 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard+ CVSS 3.1| 9.8 Critical...

REDCap >= 13.3.0 - Unauthenticated Remote Code Execution via Survey Passthru

REDCap versions 13.3.0 through 16.0.48 LTS, 17.3.9 LTS, and 17.4.3 Standard contain an unauthenticated remote code execution vulnerability. The application is vulnerable to an authentication bypass via a double-URL-decoded passthru parameter %2569ndex.php - index.php on public survey endpoints,...

CVE-2026-90817

CVE-2026-90817 — REDCap Unauthenticated RCE PoC Authorized Use Only AUTHORIZED USE ONLY. You are responsible for legal authorization of every target. Unauthorized use against third-party REDCap instances is illegal. Vulnerability Summary Field| Value ---|--- CVE| CVE-2026-90817 Product| Vanderbil...

CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Python 3 checker and configurable exploit hook for CVE-2026-90817 Securifera / Ryan Wincey. | ---|--- Product| REDCap Vanderbilt Affected| ≥ 13.3.0 until branch patch Fixed| 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard+ CVSS 3.1| 9.8 Critical...

CVE-2024-55374

CVE-2024-55374 Redcap 14.3.13 is vulnerable to user enumeration because it returns distinct error messages depending on whether the user exists or not. This allows an attacker to send multiple HTTP authentication requests to perform brute-force attacks. Although a protection mechanism exists to...

cve-2020-27358-27359

CVE-2020-27358 / CVE-2020-27359 Exploitation steps for CVE-2020-27358 and CVE-2020-27359 CVE-2020-27358 An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature that allows users to export their conversation threads as CSV allows non-privileged users to export o...

redcap_cve_2026_90817_scan

CVE-2026-90817 REDCap compromise scanner redcapcve202690817scan.py is a read-only, passive scanner that checks a REDCap host for exposure to and compromise by CVE-2026-90817 — the unauthenticated survey-endpoint remote-code-execution flaw abused by the XMRig cryptomining campaign documented by Pa...

REDCap 17.4.3 Survey Passthru Data Import RCE Checker

REDCap versions 13.3.0 through affected pre-fixed branches contain a survey passthru and Data Import path/stream handling issue that may allow remote code execution. This tool fingerprints targets, validates public survey hashes, and probes passthru routes...

Exploit for CVE-2026-90817

CVE-2026-90817 REDCap compromise scanner redcapcve2026908...

VulnCheck KEV: CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

Exploit for CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Pyt...

REDCap 13.3.0+ Survey Passthrough Scanner

REDCap versions 13.3.0 and higher contain an unauthenticated remote code execution vulnerability in survey passthrough routing and Data Import processing. This Python tool fingerprints candidate instances, evaluates version information and public survey hashes, and probes relevant routes...

Exploit for CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Pyt...

REDCap 17.4.3 Survey Passthru Data Import Checker

REDCap versions 13.3.0 through 16.0.48, 17.0.0 through 17.3.9, and 17.4.0 through 17.4.3 contain an unauthenticated remote code execution vulnerability in survey passthrough routing and Data Import processing. This tool fingerprints instances and probes public-survey passthrough routes...

Exploit for CVE-2026-90817

CVE-2026-90817 — REDCap Unauthenticated RCE PoC Authorized Us...

Exploit for CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Pyt...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

REDCap versions 13.3.0 and higher are vulnerable to an unauthenticated Remote Code Execution (RCE) . The flaw exists in the survey passthrough routing and Data Import processing logic . An attacker can bypass authentication by manipulating the __passthru parameter (e.g., via double-URL-decoded %2...