CVE-2019-17121

CVE-2019-17121 affects REDCap prior to 9.3.4 and involves an XSS vulnerability on the "Customize & Manage Locking/E-signatures" page triggered through Lock Record Custom Text values. The description in the sources confirms the issue but does not provide details on root cause, affected modules bey...

CVE-2021-42136

Summary: CVE-2021-42136 is a stored XSS in REDCap’s Missing Data Codes functionality present in versions before 11.4.0. The vulnerability allows an attacker to store JavaScript as a Missing Data Code value, which is then executed in the victim’s browser and can be leveraged to perform a Cross-Sit...

CVE-2024-37396

A stored cross-site scripting (XSS) vulnerability exists in the Calendar function of REDCap 13.1.9 . Authenticated users can execute arbitrary web scripts or HTML by injecting a crafted payload into the 'Notes' field of a calendar event, which triggers when the event is viewed. To remediate this ...

CVE-2024-37394

REDCap version 13.1.9 contains a stored cross-site scripting (XSS) vulnerability within the Project Dashboards component. Authenticated users can execute arbitrary web scripts or HTML by injecting a crafted payload into the 'Dashboard title' and 'Dashboard content' text boxes. This vulnerability ...

CVE-2024-37395

REDCap version 13.1.9 is affected by a stored cross-site scripting (XSS) vulnerability within the Public Survey function. Authenticated users can inject crafted payloads into the 'Survey Title' and 'Survey Instructions' fields, allowing for the execution of arbitrary web scripts or HTML when the ...

CVE-2022-42715

Affected software: REDCap (prior to 12.04.18). Vulnerability: Reflected XSS in the Alerts & Notifications upload feature. A crafted CSV file can cause arbitrary JavaScript execution in the user’s browser. Root cause / scope: Unclear from provided docs beyond the XSS result via CSV upload; the iss...

CVE-2023-37361

CVE-2023-37361 affects REDCap versions 12.0.26 LTS and 12.3.2 Standard. The vulnerability is a SQL injection coming from specific parameters (scheduling, repeatforms, purpose, app_title, randomization) used in various function points, potentially enabling unauthorized data access or manipulation ...

CVE-2019-15127

CVE-2019-15127 affects REDCap prior to 9.3.0. The issue is an XSS vulnerability on the Data Import Tool page, exploitable by a CSV data import file and affecting non-administrator accounts. The description in public records does not specify the underlying root cause or CVE exploit vectors beyond ...

CVE-2023-38825

Vanderbilt REDCap versions prior to v.13.8.0 are vulnerable to an SQL injection vulnerability. A remote attacker can exploit the password reset mechanism located at the MyCapMobileApp/update.php endpoint to obtain sensitive information. To remediate this issue, users should update to version 13.8...