CVE-2019-14937

PoC —

CVSS 3.0

7.5 high

EPSS

1%p71

Published

Aug 17, 2019 (Aug 17, 2019)

Modified

Jun 17, 2026

Description

REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to compromise all data.

Vendors: vanderbilt
Products: redcap
Weakness: CWE-89
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news0 stories

No ingested article mentions this CVE yet.