Cross site scripting

Invision Community aka IPS Community Suite or IP-Board before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker can rely on the ability of an admin to install widget...

Cross site scripting

Invision Community aka IPS Community Suite or IP-Board before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through a brute-force attack against the PHP mtrand function...

CVE-2021-39250

Invision Community aka IPS Community Suite or IP-Board before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker can rely on the ability of an admin to install widget...

CVE-2021-39249

Invision Community (IPS Community Suite / IP-Board) prior to 4.6.5.1 is affected by a reflected XSS vulnerability. The issue arises because uploaded file names are predictable via brute-force against PHP mt_rand, enabling an attacker to craft payloads that may be reflected. Affected product: Invi...

CVE-2021-39250

Invision Community (IPS Community Suite/IP-Board) is affected by a stored XSS in versions prior to 4.6.5.1, which can lead to code execution. The vulnerability arises because an uploaded file can be placed inside an IFRAME within user-generated content. For exploitation, an attacker can rely on t...

CVE-2021-39250

Invision Community aka IPS Community Suite or IP-Board before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker can rely on the ability of an admin to install widget...

Invision Community 安全特征问题漏洞

Invision Community is a software for designing and developing mobile application UI from Invision, Inc. A security signature vulnerability exists in Invision Community, which originates in the product's mtrand function that enables brute-force attacks on uploaded files to predict file names. The...

Invision Community 跨站脚本漏洞

Invision Community is a software for designing and developing mobile application UI from Invision Inc. in the United States. A cross-site scripting vulnerability exists in Invision Community that stems from the product's ability to allow uploading of files into IFRAME elements. The vulnerability...

Invision Community Code Injection Vulnerability

Invision Community is a software for designing and developing mobile application UI from Invision, Inc. in the United States. A code injection vulnerability exists in versions prior to Invision Community 4.6.0, which can be exploited by attackers to inject and execute arbitrary PHP code...

CVE-2021-32924

Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...

CVE-2021-32924

Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...

CVE-2021-32924

Invision Community (IPS Community Suite) before 4.6.0 is vulnerable to an eval-based PHP code injection via the moderator-accessible previewBlock path in IPS\cms\modules\front\pages_builder::previewBlock, which interacts unsafely with IPS_Theme::runProcessFunction. Root cause: unsafe handling ena...

CVE-2021-32924

Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...

Invision Community 代码注入漏洞

Invision Community is a software for designing and developing mobile application UI from Invision, Inc. in the United States. A code injection vulnerability exists in versions prior to Invision Community 4.6.0, which can be exploited by attackers to inject and execute arbitrary PHP code...

CVE-2021-3025

Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API the sortDir parameter in a sortBy=popular action to the GETindex method in applications/downloads/api/files.php...

CVE-2021-3025

Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API the sortDir parameter in a sortBy=popular action to the GETindex method in applications/downloads/api/files.php...

Sql injection

Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API the sortDir parameter in a sortBy=popular action to the GETindex method in applications/downloads/api/files.php...

CVE-2021-3025

Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API the sortDir parameter in a sortBy=popular action to the GETindex method in applications/downloads/api/files.php...

CVE-2021-3025

Summary: CVE-2021-3025 affects Invision Community IPS Community Suite up to version 4.5.4.2. The vulnerability is an SQL Injection in the Downloads REST API, triggered by the sortDir parameter via sortBy=popular in the GETindex() method of /applications/downloads/api/files.php. The issue could al...

Invision Community SQL Injection Vulnerability

Invision Community is a software for designing and developing UI for mobile applications by Invision USA. An SQL injection vulnerability exists in IPS Community Suite versions 4.5.4, which originates from the Downloads REST API...