7.5.0

DATE	CVE	VULNERABILITY TITLE	RISK
2023-09-07	CVE-2023-37798	Cross-site Scripting vulnerability in Vanderbilt Redcap A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.35 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the project title parameter. network low complexity vanderbilt CWE-79	5.4
2023-07-25	CVE-2023-37361	SQL Injection vulnerability in Vanderbilt Redcap REDCap 12.0.26 LTS and 12.3.2 Standard allows SQL Injection via scheduling, repeatforms, purpose, app_title, or randomization. network low complexity vanderbilt CWE-89	2.7
2022-10-12	CVE-2022-42715	Cross-site Scripting vulnerability in Vanderbilt Redcap A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. network low complexity vanderbilt CWE-79	6.1
2022-04-13	CVE-2021-42136	Cross-site Scripting vulnerability in Vanderbilt Redcap A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the client's browser by storing said code as a Missing Data Code value. network vanderbilt CWE-79	3.5
2017-07-18	CVE-2017-10962	Cross-site Scripting vulnerability in Vanderbilt Redcap REDCap before 7.5.1 has XSS via the query string. network vanderbilt CWE-79	4.3
2017-07-18	CVE-2017-10961	Cross-Site Request Forgery (CSRF) vulnerability in Vanderbilt Redcap REDCap before 7.5.1 has CSRF in the deletion feature of the File Repository and File Upload components. network vanderbilt CWE-352	6.8