CVE-2022-40238

CVE-2022-40238: A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5

Vendor Cert/Cc

Product VINCE - The Vulnerability Information and Coordination Environment

Weakness CWE-502 · Unsafe deserialization

Published October 26, 2022

Last update May 7, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed.

Key dates

02Disclosure timeline

October 26, 2022 CVE published

May 7, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-40238 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html

Related vulnerabilities

04Related CVE

CVE-2026-12115 Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import CVE-2026-39498 WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability CVE-2026-39532 WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability CVE-2026-49781 WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability CVE-2026-56121 Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization