Skip to content
OpenAdvisories
Unscored CVE-2022-40248 EUVD-2022-43546GHSA-hjm9-vw3p-4gv8

An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4

Published Oct 10, 2022 · Updated Aug 3, 2024 · Assigned by certcc

Vendor: CERT/CC Product: VINCE - The Vulnerability Information and Coordination Environment

Description

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field.

Affected products

VendorProductAffectedFixed
CERT/CC VINCE - The Vulnerability Information and Coordination Environment 1.48.0 – < 1.50.4 1.50.4

References