CVE-2020-27359

A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user could craft a message and send it to anyone on the platform including admins. The XSS payload would execute on the other account without interaction from the user on several pages.

• CWE-79

• https://github.com/seb1055/cve-2020-27358-27359Third Party Advisory
• https://www.evms.edu/research/resources_services/redcap/redcap_change_log/Release Notes, Vendor Advisory
• https://www.ruse.tech/blog/38Third Party Advisory
• https://github.com/seb1055/cve-2020-27358-27359Third Party Advisory
• https://www.evms.edu/research/resources_services/redcap/redcap_change_log/Release Notes, Vendor Advisory
• https://www.ruse.tech/blog/38Third Party Advisory

Published

Nov 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-27352When generating the systemd service units for the docker sna…8.8
• CVE-2020-27353Rejected reason: CVE ID was once reserved, but never used.
• CVE-2020-27354Rejected reason: CVE ID was once reserved, but never used.
• CVE-2020-27355Rejected reason: CVE ID was once reserved, but never used.
• CVE-2020-27356The debug-meta-data plugin 1.1.2 for WordPress allows XSS.5.4
• CVE-2020-27358An issue was discovered in REDCap 8.11.6 through 9.x before …4.3
• CVE-2020-27361An issue exists within Akkadian Provisioning Manager 4.50.02…7.5
• CVE-2020-27362An issue exists within the SSH console of Akkadian Provision…8.8
• CVE-2020-27366Cross Site Scripting (XSS) vulnerability in wlscanresults.ht…6.1
• CVE-2020-27368Directory Indexing in Login Portal of Login Portal of TOTOLI…5.5
• CVE-2020-2737Vulnerability in the Core RDBMS component of Oracle Database…6.4
• CVE-2020-27372A buffer overflow vulnerability exists in Brandy Basic V Int…9.8