What’s Vulnerable › Vulnerabilities

CVE-2020-26712

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-01-12 · updated 2026-06-17
• Weakness: CWE-89

Description

REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information from the submitted user that is not validated well in the database query, resulting in an SQL injection vulnerability where an attacker can exploit and compromise all databases.

Affected products

• Vanderbilt REDCap: 10.0.20, 10.3.4

References

• https://github.com/vuongdq54/RedCap
• https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
• https://www.project-redcap.org/
• https://github.com/vuongdq54/RedCap
• https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
• https://www.project-redcap.org/

Get alerted when CVE-2020-26712 or the next vulnerability affects your stack