CVE-2026-8142

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates...

CVE-2026-8142 CVE-2026-8142

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates...

CVE-2026-8142 CVE-2026-8142

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates...

EUVD-2022-43546

Malicious code in bioql PyPI...

PT-2024-16298 · Vince · Vince

Name of the Vulnerable Software and Affected Versions: VINCE versions prior to 3.0.9 Description: The issue allows exposure of user information to authenticated users. Recommendations: For versions prior to 3.0.9, update to version 3.0.9 or later to resolve the issue...

CVE-2024-9953 Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8

A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...

CVE-2024-9953 Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8

A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...

CVE-2022-40257

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field...

CVE-2022-40248

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field...

PT-2022-5025 · Unknown · Cert/Cc Vince

Name of the Vulnerable Software and Affected Versions: CERT/CC VINCE versions prior to 1.50.4 Description: An HTML injection issue exists, allowing an authenticated attacker to inject arbitrary HTML via a form using the Product Affected field. This can be exploited by a remote attacker...

CVE-2022-25799 An open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.0

An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated user clicks the link, the authenticated user's browser could be redirected to a malicious...

CVE-2022-25799

An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated user clicks the link, the authenticated user's browser could be redirected to a malicious...