CVE-2024-9953: Cert Vince

Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days.

A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restricts unpickling to prevent server crashes, this vulnerability could still disrupt operations.

Affected products

• Cert Vince: before 3.0.8 (fixed in 3.0.8)

Published 2024-10-14. Last modified 2026-06-17.