CVE-2020-26712 - CVE House
Back to Database
Status published Critical CVE-2020-26712

REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList...

Vulnerability Description

REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information from the submitted user that is not validated well in the database query, resulting in an SQL injection vulnerability where an attacker can exploit and compromise all databases.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-26712

Credits & Attribution

No credits recorded in the NVD database.

References

More from vanderbilt

View All →
CVE-2022-42715
A reflected XSS vulnerability exists in REDCap before 12.04.18 in...
Unknown 0
CVE-2022-24127
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php...
Medium 5.4
CVE-2022-24004
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messenger_ajax.php...
Medium 5.4
CVE-2021-42136
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data...
Critical 9
CVE-2020-27358
An issue was discovered in REDCap 8.11.6 through 9.x before...
Medium 4.3

Affected Vendor

Affected Software

redcap
Vulnerable Versions:
10.0.20, 10.3.4

Timeline

Official Publish: January 12th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.