redcap vulnerabilities and fixes

Recent CVEs affecting redcap, with upgrade or downgrade steps. 16 tracked.

redcap has 16 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2026-01-02. Highest priority: CVE-2024-56311 (score 42/100).

• CVE-2024-55374 MEDIUM 5.3 DOWNGRADE REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attemp
• CVE-2025-23113 LOW 3.4 DOWNGRADE An issue was discovered in REDCap 14.9.6
• CVE-2025-23112 MEDIUM 6.1 DOWNGRADE An issue was discovered in REDCap 14.9.6
• CVE-2025-23111 MEDIUM 4.7 DOWNGRADE An issue was discovered in REDCap 14.9.6
• CVE-2025-23110 MEDIUM 6.1 DOWNGRADE An issue was discovered in REDCap 14.9.6
• CVE-2024-56377 MEDIUM 5.4 DOWNGRADE A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users
• CVE-2024-56376 MEDIUM 5.4 DOWNGRADE A stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6 allows authentica
• CVE-2024-56314 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenti
• CVE-2024-56313 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 14.9.6 allows auth
• CVE-2024-56312 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in the Project Dashboard name of REDCap through 14.9.6 allow
• CVE-2024-56311 HIGH 8.8 UPGRADE REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-S
• CVE-2024-56310 HIGH 8.8 UPGRADE REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Reque
• CVE-2024-45527 MEDIUM 6.1 DOWNGRADE REDCap 14.7.0 allows HTML injection via the project title of a New Project action
• CVE-2024-37396 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in the Calendar function of REDCap 13.1.9 allows authenticat
• CVE-2024-37395 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9 allows authen
• CVE-2024-37394 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in the Project Dashboards of REDCap 13.1.9 allows authentica

FAQ

How do I fix redcap vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is redcap being exploited right now?

None of the tracked redcap CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which redcap CVE should I patch first?

CVE-2024-56311 currently ranks highest (42/100): REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-S.

RSS feed for redcap · ← Back to latest CVEs