CVE-2022-40248

Name of the Vulnerable Software and Affected Versions CERT/CC VINCE versions prior to 1.50.4

Description An HTML injection issue exists, allowing an authenticated attacker to inject arbitrary HTML via a form using the Product Affected field. This can be exploited by a remote attacker.

Recommendations For versions prior to 1.50.4, update to version 1.50.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Product Affected field in the form until a patch is applied.