REDCap before 7.5.1 has XSS via the query string.
https://gist.github.com/jordanpotti/fef4f1ada404d5ba7f88ab42e93cdaae
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-2600
https://community.projectredcap.org/articles/13/changelog-standard-release.html