CVE-2021-42136: Vanderbilt Redcap

Critical severity, CVSS 9.0. EPSS: 4.7% chance of exploitation in the next 30 days.

A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the client's browser by storing said code as a Missing Data Code value. This can then be leveraged to execute a Cross-Site Request Forgery attack to escalate privileges to administrator.

Affected products

• Vanderbilt Redcap: before 11.4.0 (fixed in 11.4.0)

Published 2022-04-13. Last modified 2026-06-17.