CVE-2020-26713

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login session information or borrow user rights to perform unauthorized acts.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/vuongdq54/RedCapExploit, Third Party Advisory
https://www.evms.edu/research/resources_services/redcap/redcap_change_log/Release Notes, Vendor Advisory
https://www.project-redcap.org/Product, Vendor Advisory
https://github.com/vuongdq54/RedCapExploit, Third Party Advisory
https://www.evms.edu/research/resources_services/redcap/redcap_change_log/Release Notes, Vendor Advisory
https://www.project-redcap.org/Product, Vendor Advisory

Timeline

Published: Jan 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-26728.2Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display). Supported versions that are affect CVE-2020-267289.8A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42_multi and Tenda AC9 V1.0 V15.03.05.19(6318)_CN which allows for remote code ex CVE-2020-26737.5Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Oracle Flow Builder). Supported versi CVE-2020-267327.5SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session,CVE-2020-267335.4Cross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated CVE-2020-26748.2Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior CVE-2020-26757.1Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Login). The supported version that is CVE-2020-267599.8clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via CVE-2020-26766.1Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Printing). The supported version that CVE-2020-267629.8A stack-based buffer-overflow exists in Edimax IP-Camera IC-3116W (v3.06) and IC-3140W (v3.07), which allows an unauthenticated, unauthorize CVE-2020-267637.5The Rocket.Chat desktop application 2.17.11 opens external links without user interaction.CVE-2020-267668.8A Cross Site Request Forgery (CSRF) vulnerability exists in the loginsystem page in PHPGurukul User Registration & Login and User Management