Vanderbilt's vulnerability profile centers on a small set of research and health-care focused software products, most notably REDCap (a widely adopted clinical data management platform) and the Adaptive Communication Environment. Despite the narrow product footprint, these platforms have moderate prominence in the research and medical informatics landscape due to their deployment across academic institutions and healthcare systems. The recurring exposure concentrates in web application weakness classes including cross-site scripting, SQL injection, cross-site request forgery, and permission misconfigurations, reflecting the input-handling and access-control demands of data-sensitive web applications serving regulated environments. Defenders managing these platforms should treat application-layer patches as high-priority given their role in handling sensitive research and patient data. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Vanderbilt over time
Signals from CVEs in this vendor scope (42 CVEs).
42 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-42136CRITICAL A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the client's | Apr 13, 2022 | 9.0 | 42 | NO | YES |
CVE-2020-26712CRITICAL REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information from the submitted us | Jan 12, 2021 | 9.8 | 31 | NO | NO |
CVE-2014-6311CRITICAL generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges. | Nov 22, 2019 | 9.8 | 31 | NO | NO |
CVE-2017-7351HIGH A SQL injection issue exists in a file upload handler in REDCap 7.x before 7.0.11 via a trailing substring to SendITController:upload. | Feb 8, 2018 | 8.8 | 28 | NO | NO |
CVE-2013-4610HIGH Unspecified vulnerability in the Data Search utility in data-entry forms in REDCap before 5.0.3 and 5.1.x before 5.1.2 has unknown impact and remote attack vectors. | Jun 17, 2013 | 10.0 | 28 | NO | NO |
CVE-2019-13029MEDIUM Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious | Jul 11, 2019 | 4.8 | 27 | NO | YES |
CVE-2017-10961HIGH REDCap before 7.5.1 has CSRF in the deletion feature of the File Repository and File Upload components. | Jul 18, 2017 | 8.8 | 26 | NO | NO |
CVE-2019-14937HIGH REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The att | Aug 17, 2019 | 7.5 | 25 | NO | NO |
CVE-2013-4611HIGH Multiple unspecified vulnerabilities in REDCap before 5.1.1 allow remote attackers to have an unknown impact via vectors involving (1) the Online Designer page or (2) the Manage Su | Jun 17, 2013 | 10.0 | 25 | NO | NO |
CVE-2025-23113HIGH An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while performing an upload of a CSV file containing a list of alert con | Jan 10, 2025 | 8.8 | 24 | NO | NO |
Signals from CVEs in this vendor scope (42 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Vanderbilt.
Media articles that mention a CVE ID that affects a product developed by Vanderbilt — matched by CVE ID, not by vendor name.