CVE-2024-55374 | Medium | 5.3 | 2026-01-02 | REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts. |
CVE-2024-37396 | Medium | 5.4 | 2025-06-10 | A stored cross-site scripting (XSS) vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML… |
CVE-2024-37395 | Medium | 5.4 | 2025-06-10 | A stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or… |
CVE-2024-37394 | Medium | 5.4 | 2025-06-10 | A stored cross-site scripting (XSS) vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML… |
CVE-2025-23113 | Low | 3.4 | 2025-01-10 | An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while performing an upload of a CSV file containin… |
CVE-2025-23112 | Medium | 6.1 | 2025-01-10 | An issue was discovered in REDCap 14.9.6. A stored cross-site scripting (XSS) vulnerability allows authenticated users to inject malicious scripts into the Sur… |
CVE-2025-23111 | Medium | 4.7 | 2025-01-10 | An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacke… |
CVE-2025-23110 | Medium | 6.1 | 2025-01-10 | An issue was discovered in REDCap 14.9.6. A Reflected cross-site scripting (XSS) vulnerability in the email-subject field exists while performing an upload of… |
CVE-2024-56377 | Medium | 5.4 | 2025-01-09 | A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the Survey Titl… |
CVE-2024-56376 | Medium | 5.4 | 2025-01-09 | A stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the me… |
CVE-2024-56314 | Medium | 5.4 | 2024-12-22 | A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the… |
CVE-2024-56313 | Medium | 5.4 | 2024-12-22 | A stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into… |
CVE-2024-56312 | Medium | 5.4 | 2024-12-22 | A stored cross-site scripting (XSS) vulnerability in the Project Dashboard name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts… |
CVE-2024-56311 | High | 8.8 | 2024-12-22 | REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker ca… |
CVE-2024-56310 | High | 8.8 | 2024-12-22 | REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit… |
CVE-2024-45527 | Medium | 6.1 | 2024-09-02 | REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via index.php?logout=1, and can also… |
CVE-2023-38825 | Medium | 6.5 | 2024-03-21 | SQL injection vulnerability in Vanderbilt REDCap before v.13.8.0 allows a remote attacker to obtain sensitive information via the password reset mechanism in M… |
CVE-2023-37798 | Medium | 5.4 | 2023-09-07 | A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.35 allows attackers to execute arbitrar… |
CVE-2023-37361 | Low | 2.7 | 2023-07-25 | REDCap 12.0.26 LTS and 12.3.2 Standard allows SQL Injection via scheduling, repeatforms, purpose, app_title, or randomization. |
CVE-2022-42715 | Medium | 6.1 | 2022-10-12 | A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. A crafted CSV file will, when uploaded, trigger ar… |
CVE-2022-24127 | Medium | 5.4 | 2022-06-15 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php in REDCap 12.0.11. This issue allows any user with… |
CVE-2022-24004 | Medium | 5.4 | 2022-06-15 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messenger_ajax.php in REDCap 12.0.11. This issue allows any authenticated user to… |
CVE-2021-42136 | Critical | 9.0 | 2022-04-13 | A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript… |
CVE-2020-26713 | Medium | 6.1 | 2021-01-12 | REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the r… |
CVE-2020-26712 | Critical | 9.8 | 2021-01-12 | REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information… |
CVE-2020-27358 | Medium | 4.3 | 2020-11-02 | An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) all… |
CVE-2014-6311 | Critical | 9.8 | 2019-11-22 | generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges. |
CVE-2019-17121 | Medium | 5.4 | 2019-10-04 | REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values. |
CVE-2019-15127 | Medium | 5.4 | 2019-08-21 | REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file. |
CVE-2019-14937 | High | 7.5 | 2019-08-17 | REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_po… |
CVE-2019-13029 | Medium | 4.8 | 2019-07-11 | Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to injec… |
CVE-2017-7351 | High | 8.8 | 2018-02-08 | A SQL injection issue exists in a file upload handler in REDCap 7.x before 7.0.11 via a trailing substring to SendITController:upload. |
CVE-2017-10962 | Medium | 6.1 | 2017-07-18 | REDCap before 7.5.1 has XSS via the query string. |
CVE-2017-10961 | High | 8.8 | 2017-07-18 | REDCap before 7.5.1 has CSRF in the deletion feature of the File Repository and File Upload components. |
CVE-2013-4612 | | | 2013-06-17 | Multiple cross-site scripting (XSS) vulnerabilities in REDCap before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vector… |
CVE-2013-4611 | | | 2013-06-17 | Multiple unspecified vulnerabilities in REDCap before 5.1.1 allow remote attackers to have an unknown impact via vectors involving (1) the Online Designer page… |
CVE-2013-4610 | | | 2013-06-17 | Unspecified vulnerability in the Data Search utility in data-entry forms in REDCap before 5.0.3 and 5.1.x before 5.1.2 has unknown impact and remote attack vec… |
CVE-2013-4609 | | | 2013-06-17 | REDCap before 5.0.4 and 5.1.x before 5.1.3 does not reject certain undocumented syntax within branching logic and calculations, which allows remote authenticat… |
CVE-2013-4608 | | | 2013-06-17 | Cross-site scripting (XSS) vulnerability in REDCap before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via vectors involving the Graphi… |
CVE-2012-6566 | | | 2013-06-17 | Cross-site scripting (XSS) vulnerability in REDCap before 4.14.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2012-6565 | | | 2013-06-17 | Cross-site scripting (XSS) vulnerability in REDCap before 4.14.3 allows remote authenticated users to inject arbitrary web script or HTML via uppercase charact… |
CVE-2012-6564 | | | 2013-06-17 | Cross-site scripting (XSS) vulnerability in REDCap before 4.14.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |