CVE-2019-14937

REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to compromise all data.

• CWE-89

• https://gist.github.com/hiennv20/6739606a4d0d25612f5139ec391060b7Exploit, Third Party Advisory
• https://projectredcap.org/resources/community/Vendor Advisory
• https://www.evms.edu/research/resources_services/redcap/redcap_change_log/Release Notes
• https://gist.github.com/hiennv20/6739606a4d0d25612f5139ec391060b7Exploit, Third Party Advisory
• https://projectredcap.org/resources/community/Vendor Advisory
• https://www.evms.edu/research/resources_services/redcap/redcap_change_log/Release Notes

Published

Aug 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14931An issue was discovered on Mitsubishi Electric Europe B.V. M…9.8
• CVE-2019-14932The Recruitment module in Humanica Humatrix 7 1.0.0.681 and …
• CVE-2019-14933Bagisto 0.1.5 allows CSRF under /admin URIs.
• CVE-2019-14934An issue was discovered in PDFResurrect before 0.18. pdf_loa…7.8
• CVE-2019-149353CX Phone 15 on Windows has insecure permissions on the "%PR…
• CVE-2019-14936Easy!Appointments 1.3.2 plugin for WordPress allows Sensitiv…5.3
• CVE-2019-14939An issue was discovered in the mysql (aka mysqljs) module 2.…
• CVE-2019-1494Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-14940In Storage Performance Development Kit (SPDK) before 19.07, …
• CVE-2019-14941SHAREit through 4.0.6.177 does not check the body length fro…7.5
• CVE-2019-14942An issue was discovered in GitLab Community and Enterprise E…5.9
• CVE-2019-14943An issue was discovered in GitLab Community and Enterprise E…