Description

An issue was discovered in REDCap 14.9.6. A Reflected cross-site scripting (XSS) vulnerability in the email-subject field exists while performing an upload of a CSV file containing a list of alert configurations. An attacker can send the victim a CSV file containing the XSS payload in the email-subject. Once the victim uploads the file, he automatically lands on a page to view the uploaded data. If the victim clicks on the email-subject value, it triggers the XSS payload.

INFO

Published Date :

2025-01-10T00:00:00.000Z

Last Modified :

2025-01-13T20:52:26.172Z

Source :

mitre
AFFECTED PRODUCTS

The following products are affected by CVE-2025-23110 vulnerability.

Vendors Products
Vanderbilt
  • Redcap
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-23110.

URL Resource
https://github.com/ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE_VVVVVV/README.md cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact