CVE-2022-40257CWE-74

An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4

published October 10, 2022

CVSS
—
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.5th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2022-10-10T00:00Z
EPSS history
Timeline
  • 10 OCT 00:00Z
    An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4
    cvelistv5