HTML Injection Vulnerability in REDCap by Vanderbilt University
CVE-2025-23111

6.1MEDIUM

Key Information:

Vendor

Vanderbilt University

Status
Redcap
Vendor
CVE Published:
10 January 2025

What is CVE-2025-23111?

An issue in REDCap version 14.9.6 permits HTML Injection via the Survey field name, potentially redirecting users to malicious phishing sites. Attackers can exploit this vulnerability to deceive users into clicking on manipulated field names, leading them to compromised URLs. This can facilitate unauthorized actions without the user's knowledge, posing significant security risks.

References

https://github.com/ping-oui-no/Vulnerability-Research-CVE...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.