CVE-2025-47916 | Critical | 10.0 | 2025-05-16 | Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor contr… |
CVE-2024-30163 | Critical | 9.8 | 2024-06-07 | Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryVi… |
CVE-2021-40604 | Critical | 9.1 | 2022-06-13 | A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger d… |
CVE-2021-39250 | Medium | 5.4 | 2021-08-17 | Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be place… |
CVE-2021-39249 | Medium | 6.1 | 2021-08-17 | Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through… |
CVE-2021-32924 | High | 8.8 | 2021-06-01 | Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\_builder… |
CVE-2021-3025 | High | 8.8 | 2021-01-08 | Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the… |
CVE-2021-3026 | Medium | 6.1 | 2021-01-05 | Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment. |
CVE-2020-29477 | Medium | 4.8 | 2020-12-30 | Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS payload… |
CVE-2009-5159 | Medium | 6.1 | 2020-03-13 | Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment. |
CVE-2013-3725 | Critical | 9.8 | 2020-02-12 | Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution. |
CVE-2012-2226 | Critical | 9.8 | 2020-01-09 | Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary… |
CVE-2019-8278 | Medium | 6.1 | 2019-03-02 | Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 leads to Remote Code Execution. |
CVE-2014-4928 | High | 8.8 | 2018-03-20 | SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId pa… |
CVE-2017-8899 | High | 8.1 | 2017-05-11 | Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature f… |
CVE-2017-8898 | Critical | 9.8 | 2017-05-11 | Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Bo… |
CVE-2017-8897 | Medium | 6.1 | 2017-05-11 | Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?co… |
CVE-2016-2564 | Medium | 5.9 | 2017-04-23 | Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Att… |
CVE-2016-6174 | High | 8.1 | 2016-07-12 | applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13… |
CVE-2015-6812 | | | 2015-09-04 | Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.0.12.1 allows remote attackers to cause a denial of servic… |
CVE-2014-9239 | | | 2014-12-03 | SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x thro… |
CVE-2014-5106 | | | 2014-07-28 | Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary we… |
CVE-2014-3149 | | | 2014-07-03 | Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or I… |
CVE-2012-5692 | | | 2012-10-31 | Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack… |
CVE-2010-3424 | | | 2010-09-16 | Cross-site scripting (XSS) vulnerability in admin/sources/classes/bbcode/custom/defaults.php in Invision Power Board (IP.Board) 3.1.2 allows remote attackers t… |
CVE-2009-3974 | | | 2009-11-18 | Multiple SQL injection vulnerabilities in Invision Power Board (IPB or IP.Board) 3.0.0, 3.0.1, and 3.0.2 allow remote attackers to execute arbitrary SQL comman… |
CVE-2005-1947 | Medium | 4.3 | 2005-06-09 | Cross-site request forgery (CSRF) vulnerability in Invision Gallery before 1.3.1 allows remote attackers to delete albums and images as another user via a link… |