by Kastro
Paper/Archive/CVE-2026-63359

CVE-2026-63359

Appriss Insights Victim Information Notification Exchange (VINE) — Appriss Insights VINE SQLI

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.9.549 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information from the database.

Affected

ProductAffectedFixed inSource
Victim Information Notification Exchange (VINE)< 2026-05-072026-05-07CNA

Scores by source

cisa-cg (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cisa-cg (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcve.org/CVERecord?id=CVE-2026-63359writeupraw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-204-01.json