PT-2025-4828 · Redcap · Redcap

Published 2025-01-10 · Updated 2025-01-11 · CVE-2025-23112

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions REDCap version 14.9.6

Description A stored cross-site scripting (XSS) issue allows authenticated users to inject malicious scripts into the Survey field name of Survey. When a user receives the survey and clicks on the field name, it triggers the XSS payload.

Recommendations For REDCap version 14.9.6, consider restricting access to the Survey field name to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid clicking on field names in surveys from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-23112

Affected Products

Redcap

References · 6

• 🔥 https://github.com/ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE_ZZZZ/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-23112 · Security Note
• https://osv.dev/vulnerability/CVE-2025-23112 · Vendor Advisory
• https://twitter.com/CVEnew/status/1877841227011305931 · Twitter Post
• https://t.me/cvedetector/15011 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1878045447182270493 · Twitter Post