https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-55374.htmlhttps://patchthecve.com/cve/CVE-2024-55374.htmlSun, 05 Jul 2026 02:16:48 +0000MEDIUM 5.3: REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.https://patchthecve.com/cve/CVE-2024-37396.htmlhttps://patchthecve.com/cve/CVE-2024-37396.htmlWed, 17 Jun 2026 07:38:17 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Notes' field of a calendar event. This could lead to the execution of malicious scripts when the evehttps://patchthecve.com/cve/CVE-2024-37395.htmlhttps://patchthecve.com/cve/CVE-2024-37395.htmlWed, 17 Jun 2026 07:38:17 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Survey Title' and 'Survey Instructions' fields. This vulnerability could be exploited by attackhttps://patchthecve.com/cve/CVE-2024-37394.htmlhttps://patchthecve.com/cve/CVE-2024-37394.htmlWed, 17 Jun 2026 07:38:17 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Dashboard title' and 'Dashboard content' text boxes. This can lead to the execution of malicious schttps://patchthecve.com/cve/CVE-2025-23113.htmlhttps://patchthecve.com/cve/CVE-2025-23113.htmlWed, 17 Jun 2026 08:52:06 +0000LOW 3.4: An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while performing an upload of a CSV file containing a list of alert configuration. An attacker can send the victim a CSV file containing an HTML injection payload in the alert-title. Once thehttps://patchthecve.com/cve/CVE-2025-23112.htmlhttps://patchthecve.com/cve/CVE-2025-23112.htmlWed, 17 Jun 2026 08:52:06 +0000MEDIUM 6.1: An issue was discovered in REDCap 14.9.6. A stored cross-site scripting (XSS) vulnerability allows authenticated users to inject malicious scripts into the Survey field name of Survey. When a user receive the survey, if he clicks on the field name, it triggers the XSS payload.https://patchthecve.com/cve/CVE-2025-23111.htmlhttps://patchthecve.com/cve/CVE-2025-23111.htmlWed, 17 Jun 2026 08:52:05 +0000MEDIUM 4.7: An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacker can exploit this to trick the user that receives the survey into clicking on the field name, which redirects them to a phishing website. Thhttps://patchthecve.com/cve/CVE-2025-23110.htmlhttps://patchthecve.com/cve/CVE-2025-23110.htmlWed, 17 Jun 2026 08:52:05 +0000MEDIUM 6.1: An issue was discovered in REDCap 14.9.6. A Reflected cross-site scripting (XSS) vulnerability in the email-subject field exists while performing an upload of a CSV file containing a list of alert configurations. An attacker can send the victim a CSV file containing the XSS payload in the email-subjhttps://patchthecve.com/cve/CVE-2024-56377.htmlhttps://patchthecve.com/cve/CVE-2024-56377.htmlWed, 17 Jun 2026 08:12:08 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the Survey Title field or Survey Instructions. When a user receives a survey and clicks anywhere on the survey page to enter data, the crafted payload (whichttps://patchthecve.com/cve/CVE-2024-56376.htmlhttps://patchthecve.com/cve/CVE-2024-56376.htmlWed, 17 Jun 2026 08:12:08 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the message field. When a user click on the received message, the crafted payload is executed, potentially enabling the execution of arbitrary web https://patchthecve.com/cve/CVE-2024-56314.htmlhttps://patchthecve.com/cve/CVE-2024-56314.htmlWed, 17 Jun 2026 08:12:01 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the name field of a Project. When a user clicks on the project name to access it, the crafted payload is executed, potentially enabling the execuhttps://patchthecve.com/cve/CVE-2024-56313.htmlhttps://patchthecve.com/cve/CVE-2024-56313.htmlWed, 17 Jun 2026 08:12:01 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the Notes field of a calendar event. When the event is viewed, the crafted payload is executed, potentially enabling the execution of arbitrahttps://patchthecve.com/cve/CVE-2024-56312.htmlhttps://patchthecve.com/cve/CVE-2024-56312.htmlWed, 17 Jun 2026 08:12:01 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the Project Dashboard name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the name field of a Project Dashboard. When a user clicks on the project Dashboard name, the crafted payload is executed, potentially ehttps://patchthecve.com/cve/CVE-2024-56311.htmlhttps://patchthecve.com/cve/CVE-2024-56311.htmlWed, 17 Jun 2026 08:12:01 +0000HIGH 8.8: REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into accessing a calendar event's notes, which triggers a logout request and terminates their session. This vuhttps://patchthecve.com/cve/CVE-2024-56310.htmlhttps://patchthecve.com/cve/CVE-2024-56310.htmlWed, 17 Jun 2026 08:12:00 +0000HIGH 8.8: REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and terhttps://patchthecve.com/cve/CVE-2024-45527.htmlhttps://patchthecve.com/cve/CVE-2024-45527.htmlWed, 17 Jun 2026 07:54:23 +0000MEDIUM 6.1: REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via index.php?logout=1, and can also be used to insert a link to an external phishing website.