Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting

Exploit Title: Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting Date: 02-12-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://invisioncommunity.com/ Software Link: https://invisioncommunity.com/buy Version: 4.5.4 Tested on: Windows 10/Kali Linux CVE:...

PUBG: RXSS to Stored XSS - forums.pubg.com | URL parameter

René Kroka found a Reflected XSS vulnerability that could be chained to a Stored XSS attack in the Invision Community forums software used by PUBG. By crafting a malicious URL the attacker is able to trigger Javascript to execute on their own page; known as Reflected XSS. The attacker then create...

Invision Power Services Community Suite Cross-Site Scripting Vulnerability (CNVD-2017-06920)

Invision Power Services IPS Community Suite is an integrated application for building communities on the web. A cross-site scripting vulnerability exists in IPS Community Suite versions 4.1.19.2 and earlier. A remote attacker could exploit this vulnerability to gain access to...

CVE-2017-8899

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The...

CVE-2017-8897

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision...

Invision Power Services IPS Community Suite Resource Management Error Vulnerability

Invision Power Services IPS Community Suite a.k.a. Invision Power Board, IPB or Power Board is a PHP and MySQL based Web forum program from Invision Power Services, Inc. A security vulnerability exists in Invision Power Services IPS Community Suite 4.0.11 and earlier versions, which can be...

Invision Community Blog Mod 1.2.4 - SQL Injection Vulnerability

No description provided by source. 1. Open any blog entry 2. Try to reply to any message 3. Push Preview message button Do not post your reply 4. Save source code of opened page to your PC 5. Find this string input type='hidden' name='eid' value='BLOGENTRYID' / 6. Change BLOGENTRYID with this SQL...

Invision Community Blog 1.0/1.1 - Multiple Input Validation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/13910/info Multiple input validation vulnerabilities reportedly affect Invision Community Blog. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out...

CVE-2006-6369

SQL injection vulnerability in lib/entryreplyentry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when accessed through the "Preview message" functionality...

CVE-2006-6369

CVE-2006-6369 is an SQL injection in the Invision Community Blog Mod 1.2.4. The flaw is in the file lib/entry_reply_entry.php and is exploitable via the eid parameter when the message is previewed, allowing remote attackers to execute arbitrary SQL commands. The connected documents provide the af...

CVE-2006-6369

SQL injection vulnerability in lib/entryreplyentry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when accessed through the "Preview message" functionality...

Invision Community Blog EID SQL注入漏洞

Invision Community Blog是一款基于Invision的一个日记模块。 Invision Community Blog不充分过滤用户提交的URI输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是脚本对用户提交的'EID'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 Invision Power Services Invision Community Blog 1.2.4 目前没有解决方案提供： http://www.invisionblog.com/...

Invision Community Blog Mod 1.2.4 SQL Injection Vulnerability

No description provided by source. 1. Open any blog entry 2. Try to reply to any message 3. Push "Preview message" button Do not post your reply 4. Save source code of opened page to your PC 5. Find this string input type='hidden' name='eid' value='BLOGENTRYID' / 6. Change BLOGENTRYID with this S...

Invision Community Blog Mod 1.2.4 - SQL Injection

Invision Community Blog Mod 1.2.4 - SQL Injection 1. Open any blog entry 2. Try to reply to any message 3. Push "Preview message" button Do not post your reply 4. Save source code of opened page to your PC 5. Find this string ' / 6. Change with this SQL Injection: UNION SELECT b.entryid, b.blogid...

Invision Community Blog Mod 1.2.4 .PHP SQL Injection Vulnerability

Open any blog entry 2. Try to reply to any message 3. Push "Preview message" button Do not post your reply 4. Save source code of opened page to your PC 5. Find this string input type='hidden' name='eid' value='BLOGENTRYID' / 6. Change BLOGENTRYID with this SQL Injection: BLOGENTRYID UNION...

Invision Community Blog Mod 1.2.4 - SQL Injection

Open any blog entry 2. Try to reply to any message 3. Push "Preview message" button Do not post your reply 4. Save source code of opened page to your PC 5. Find this string ' / 6. Change with this SQL Injection: UNION SELECT b.entryid, b.blogid, b.categoryid, b.entryauthorid, b.entryauthorname,...

Invision Community Blog Mod 1.2.4 SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================= Invision Community Blog Mod 1.2.4 SQL Injection Vulnerability ============================================================= 1. Open any blog entry 2. Try to reply to any message...

CVE-2006-2251

SQL injection vulnerability in the dommod function in mod.php in Invision Community Blog ICB 1.1.2 final through 1.2 allows remote attackers with moderator privileges to execute arbitrary SQL commands via the selectedbids parameter...

Sql injection

SQL injection vulnerability in the dommod function in mod.php in Invision Community Blog ICB 1.1.2 final through 1.2 allows remote attackers with moderator privileges to execute arbitrary SQL commands via the selectedbids parameter...

CVE-2006-2251

CVE-2006-2251: A SQL injection in the do_mmod function of mod.php in Invision Community Blog (ICB) 1.1.2 final through 1.2 allows remote attackers with moderator privileges to execute arbitrary SQL via the selectedbids parameter. Affected software is Invision Community Blog (ICB). The vulnerabili...