CVE-2022-42715: Vanderbilt Redcap

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. A crafted CSV file will, when uploaded, trigger arbitrary JavaScript code execution.

Affected products

• Vanderbilt Redcap: before 12.4.18 (fixed in 12.4.18); from 12.5.0, before 12.5.11 (fixed in 12.5.11)

Published 2022-10-12. Last modified 2026-06-17.