Victim Information Notification Exchange Vine
Monthly
SQL injection in the Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications lets an unauthenticated remote attacker send a crafted request that bypasses the login page, exposes other users' credentials, enables full account takeover, and permits dumping of sensitive PII and other database contents. VINE is the notification platform used by U.S. corrections and law enforcement agencies to alert crime victims about offender status, so exposure of its data carries direct victim-safety implications. No public exploit identified at time of analysis, but the flaw is trivially exploitable (network, no authentication, low complexity) with a CVSS 4.0 base score of 9.3.
SQL injection in the Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications lets an unauthenticated remote attacker send a crafted request that bypasses the login page, exposes other users' credentials, enables full account takeover, and permits dumping of sensitive PII and other database contents. VINE is the notification platform used by U.S. corrections and law enforcement agencies to alert crime victims about offender status, so exposure of its data carries direct victim-safety implications. No public exploit identified at time of analysis, but the flaw is trivially exploitable (network, no authentication, low complexity) with a CVSS 4.0 base score of 9.3.