[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-90817":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-21T21:38:57.784Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":312,"aliases":313,"duplicate_of":9,"upstream":314,"downstream":315,"duplicates":316,"related":317,"reserved_at":9,"published_at":318,"modified_at":319,"state":320,"summary":321,"references_raw":330,"kevs":336,"epss":337,"epss_history":340,"metrics":342,"affected":349},"CVE-2026-90817","An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.",null,[11,269],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-73","External Control of File Name or Path","The product allows user input to control or influence paths or file names that are used in filesystem operations.","weakness","Draft","Base","High",[20,204,245,249,253,257,261,265],{"id":21,"name":22,"techniques":23},"CAPEC-13","Subverting Environment Variable Values",[24,122,164],{"id":25,"name":26,"tactics":27,"countermeasures":34},"T1562.003","Impair Command History Logging",[28,31],{"id":29,"name":30},"TA0030","Defense Evasion",{"id":32,"name":33},"TA0005","Stealth",[35,40,45,50,55,60,65,69,73,77,81,86,90,94,98,102,106,110,114,118],{"id":36,"name":37,"tactic":38},"D3-RF","Restore File",{"name":39},"Restore",{"id":41,"name":42,"tactic":43},"D3-CQ","Content Quarantine",{"name":44},"Isolate",{"id":46,"name":47,"tactic":48},"D3-CI","Configuration Inventory",{"name":49},"Model",{"id":51,"name":52,"tactic":53},"D3-DF","Decoy File",{"name":54},"Deceive",{"id":56,"name":57,"tactic":58},"D3-FA","File Analysis",{"name":59},"Detect",{"id":61,"name":62,"tactic":63},"D3-DRA","Disable Remote Access",{"name":64},"Harden",{"id":66,"name":67,"tactic":68},"D3-ACH","Application Configuration Hardening",{"name":64},{"id":70,"name":71,"tactic":72},"D3-RC","Restore Configuration",{"name":39},{"id":74,"name":75,"tactic":76},"D3-FE","File Encryption",{"name":64},{"id":78,"name":79,"tactic":80},"D3-FIM","File Integrity Monitoring",{"name":59},{"id":82,"name":83,"tactic":84},"D3-RKD","Registry Key Deletion",{"name":85},"Evict",{"id":87,"name":88,"tactic":89},"D3-DA","Dynamic Analysis",{"name":59},{"id":91,"name":92,"tactic":93},"D3-CF","Content Filtering",{"name":44},{"id":95,"name":96,"tactic":97},"D3-LFP","Local File Permissions",{"name":44},{"id":99,"name":100,"tactic":101},"D3-FEV","File Eviction",{"name":85},{"id":103,"name":104,"tactic":105},"D3-EFA","Emulated File Analysis",{"name":59},{"id":107,"name":108,"tactic":109},"D3-RFAM","Remote File Access Mediation",{"name":44},{"id":111,"name":112,"tactic":113},"D3-CM","Content Modification",{"name":44},{"id":115,"name":116,"tactic":117},"D3-EAL","Executable Allowlisting",{"name":44},{"id":119,"name":120,"tactic":121},"D3-EDL","Executable Denylisting",{"name":44},{"id":123,"name":124,"tactics":125,"countermeasures":137},"T1574.006","Dynamic Linker Hijacking",[126,129,132,133,134],{"id":127,"name":128},"TA0110","Persistence",{"id":130,"name":131},"TA0111","Privilege Escalation",{"id":29,"name":30},{"id":32,"name":33},{"id":135,"name":136},"TA0104","Execution",[138,140,142,144,148,150,152,154,156,158,160,162],{"id":111,"name":112,"tactic":139},{"name":44},{"id":99,"name":100,"tactic":141},{"name":85},{"id":56,"name":57,"tactic":143},{"name":59},{"id":145,"name":146,"tactic":147},"D3-SFA","System File Analysis",{"name":59},{"id":36,"name":37,"tactic":149},{"name":39},{"id":91,"name":92,"tactic":151},{"name":44},{"id":95,"name":96,"tactic":153},{"name":44},{"id":74,"name":75,"tactic":155},{"name":64},{"id":107,"name":108,"tactic":157},{"name":44},{"id":41,"name":42,"tactic":159},{"name":44},{"id":51,"name":52,"tactic":161},{"name":54},{"id":78,"name":79,"tactic":163},{"name":59},{"id":165,"name":166,"tactics":167,"countermeasures":173},"T1574.007","Path Interception by PATH Environment Variable",[168,169,170,171,172],{"id":127,"name":128},{"id":130,"name":131},{"id":29,"name":30},{"id":32,"name":33},{"id":135,"name":136},[174,176,178,180,182,184,186,188,190,192,194,196,198,200,202],{"id":111,"name":112,"tactic":175},{"name":44},{"id":56,"name":57,"tactic":177},{"name":59},{"id":51,"name":52,"tactic":179},{"name":54},{"id":91,"name":92,"tactic":181},{"name":44},{"id":99,"name":100,"tactic":183},{"name":85},{"id":78,"name":79,"tactic":185},{"name":59},{"id":95,"name":96,"tactic":187},{"name":44},{"id":74,"name":75,"tactic":189},{"name":64},{"id":115,"name":116,"tactic":191},{"name":44},{"id":87,"name":88,"tactic":193},{"name":59},{"id":107,"name":108,"tactic":195},{"name":44},{"id":119,"name":120,"tactic":197},{"name":44},{"id":103,"name":104,"tactic":199},{"name":59},{"id":41,"name":42,"tactic":201},{"name":44},{"id":36,"name":37,"tactic":203},{"name":39},{"id":205,"name":206,"techniques":207},"CAPEC-267","Leverage Alternate Encoding",[208],{"id":209,"name":210,"tactics":211,"countermeasures":214},"T1027","Obfuscated Files or Information",[212,213],{"id":29,"name":30},{"id":32,"name":33},[215,217,219,221,223,225,227,229,231,233,235,237,239,241,243],{"id":78,"name":79,"tactic":216},{"name":59},{"id":51,"name":52,"tactic":218},{"name":54},{"id":115,"name":116,"tactic":220},{"name":44},{"id":119,"name":120,"tactic":222},{"name":44},{"id":95,"name":96,"tactic":224},{"name":44},{"id":36,"name":37,"tactic":226},{"name":39},{"id":99,"name":100,"tactic":228},{"name":85},{"id":87,"name":88,"tactic":230},{"name":59},{"id":107,"name":108,"tactic":232},{"name":44},{"id":74,"name":75,"tactic":234},{"name":64},{"id":56,"name":57,"tactic":236},{"name":59},{"id":111,"name":112,"tactic":238},{"name":44},{"id":91,"name":92,"tactic":240},{"name":44},{"id":41,"name":42,"tactic":242},{"name":44},{"id":103,"name":104,"tactic":244},{"name":59},{"id":246,"name":247,"techniques":248},"CAPEC-64","Using Slashes and URL Encoding Combined to Bypass Validation Logic",[],{"id":250,"name":251,"techniques":252},"CAPEC-72","URL Encoding",[],{"id":254,"name":255,"techniques":256},"CAPEC-76","Manipulating Web Input to File System Calls",[],{"id":258,"name":259,"techniques":260},"CAPEC-78","Using Escaped Slashes in Alternate Encoding",[],{"id":262,"name":263,"techniques":264},"CAPEC-79","Using Slashes in Alternate Encoding",[],{"id":266,"name":267,"techniques":268},"CAPEC-80","Using UTF-8 Encoding to Bypass Validation Logic",[],{"_key":270,"id":270,"name":271,"description":272,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":273,"capec":274},"CWE-94","Improper Control of Generation of Code ('Code Injection')","The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","Medium",[275,279,308],{"id":276,"name":277,"techniques":278},"CAPEC-242","Code Injection",[],{"id":280,"name":281,"techniques":282},"CAPEC-35","Leverage Executable Code in Non-Executable Files",[283,290,297],{"id":284,"name":285,"tactics":286,"countermeasures":289},"T1027.006","HTML Smuggling",[287,288],{"id":29,"name":30},{"id":32,"name":33},[],{"id":291,"name":292,"tactics":293,"countermeasures":296},"T1027.009","Embedded Payloads",[294,295],{"id":29,"name":30},{"id":32,"name":33},[],{"id":298,"name":299,"tactics":300,"countermeasures":303},"T1564.009","Resource Forking",[301,302],{"id":29,"name":30},{"id":32,"name":33},[304],{"id":305,"name":306,"tactic":307},"D3-FFV","File Format Verification",{"name":44},{"id":309,"name":310,"techniques":311},"CAPEC-77","Manipulating User-Controlled Variables",[],[],[],[],[],[],[],"2026-09-20T12:05:32.698Z","2026-09-21T14:16:08.677Z","Received",{"cisa_kev":322,"cisa_ransomware":322,"cisa_vendor":9,"epss_severity":323,"epss_score":324,"severity":325,"severity_score":326,"severity_version":327,"severity_source":328,"severity_vector":329,"severity_status":320},false,"low",0.00573,"critical",9.8,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",[331],{"url":332,"sources":333,"tags":335},"https://www.securifera.com/advisories/",[328,334],"nvd",[],[],{"date":338,"score":324,"percentile":339},"2026-09-21",0.45806,[341],{"date":338,"score":324,"percentile":339},[343,347],{"source":328,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":344,"cvss_v4_0":9},{"baseScore":326,"baseSeverity":345,"vectorString":329,"impactScore":326,"exploitabilityScore":346},"CRITICAL",10,{"source":334,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":348,"cvss_v4_0":9},{"baseScore":326,"baseSeverity":345,"vectorString":329,"impactScore":326,"exploitabilityScore":346},[350],{"ecosystem":9,"name":351,"vendor":352,"product":353,"cpe_part":354,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":355},"REDCap","vanderbilt university","redcap","a",[356],{"version":357,"is_range":322,"range_type":328,"version_start":357,"version_start_type":358,"version_end":357,"version_end_type":358,"fixed_in":9},"13.3.0","including"]