| Package | Affected versions | Patched versions |
|---|---|---|
| redcap | < 11.4.0 | 11.4.0 |
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the client's browser by storing said code as a Missing Data Code value. This can then be leveraged to execute a Cross-Site Request Forgery attack to escalate privileges to administrator.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free