CVE-2025-23111: XSS
An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacker can exploit this to trick the user that receives the survey into clicking on the field name, which redirects them to a phishing website. Thus, this allows malicious actions to be executed without user consent.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23111?
CVE-2025-23111 has a medium severity rating due to the potential for phishing attacks due to HTML injection.
How do I fix CVE-2025-23111?
To fix CVE-2025-23111, update REDCap to the latest version where this vulnerability has been patched.
Who is affected by CVE-2025-23111?
Users of REDCap version 14.9.6 are affected by CVE-2025-23111 due to its vulnerability to HTML Injection.
What are the risks associated with CVE-2025-23111?
The risks include users being redirected to phishing websites, which can lead to credential theft and data breaches.
How can I identify if CVE-2025-23111 is being exploited?
To identify exploitation of CVE-2025-23111, monitor for unusual redirects in user activity and phishing attempts linked to survey responses.