HTML Injection Vulnerability in REDCap by Vanderbilt University
CVE-2025-23111

4.7MEDIUM

Key Information:

Vendor

Vanderbilt

Status
Redcap
Vendor
CVE Published:
10 January 2025

What is CVE-2025-23111?

An issue in REDCap version 14.9.6 permits HTML Injection via the Survey field name, potentially redirecting users to malicious phishing sites. Attackers can exploit this vulnerability to deceive users into clicking on manipulated field names, leading them to compromised URLs. This can facilitate unauthorized actions without the user's knowledge, posing significant security risks.

Affected Version(s)

REDCap 14.9.6

References

https://github.com/ping-oui-no/Vulnerability-Research-CVE...

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.