Invision Power Services vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2008-4171 SQL injection vulnerability in xmlout.php in Invision Power Board (IP.Board or IPB) 2.2.x and 2.3.x allows remote attackers to execute arbitrary SQL commands viHigh 7.5 · Sep 22, 2008
• CVE-2008-0421 SQL injection vulnerability in Invision Gallery 2.0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the album parameter in a rate coHigh 7.5 · Jan 23, 2008
• CVE-2007-5688 Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision Power Board (IPB or High 7.5 · Oct 29, 2007
• CVE-2007-4913 ips_kernel/class_upload.php in Invision Power Board (IPB or IP.Board) 2.3.1 up to 20070912 allows remote attackers to upload arbitrary script files with craftedHigh 7.5 · Sep 17, 2007
• CVE-2007-3219 Unspecified vulnerability in sources/action_public/xmlout.php in Invision Power Board (IPB or IP.Board) 2.2.0 through 2.2.2 allows remote attackers to modify anHigh 7.8 · Jun 14, 2007
• CVE-2006-7071 SQL injection vulnerability in classes/class_session.php in Invision Power Board (IPB) 2.1 up to 2.1.6 allows remote attackers to execute arbitrary SQL commandsHigh 7.5 · Mar 2, 2007
• CVE-2006-7064 Cross-site scripting (XSS) vulnerability in forum/admin.php for Invision Power Board (IPB) 2.1.6 and earlier allows remote attackers to inject arbitrary web scrHigh 9.3 · Feb 23, 2007
• CVE-2006-6369 SQL injection vulnerability in lib/entry_reply_entry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the High 7.5 · Dec 7, 2006
• CVE-2006-6370 SQL injection vulnerability in forum/modules/gallery/post.php in Invision Gallery 2.0.7 allows remote attackers to cause a denial of service and possibly have oHigh 7.5 · Dec 7, 2006
• CVE-2006-5206 SQL injection vulnerability in Invision Gallery 2.0.7 allows remote attackers to execute arbitrary SQL commands via the album parameter in (1) index.php and (2)High 7.5 · Oct 10, 2006
• CVE-2006-4155 Unspecified vulnerability in func_topic_threaded.php (aka threaded view mode) in Invision Power Board (IPB) before 2.1.7 21013.60810.s allows remote attackers tHigh 7.5 · Aug 16, 2006
• CVE-2006-3543 Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.x and 2.x allow remote attackers to execute arbitrary SQL commands via the (1) idcat and High 7.5 · Jul 12, 2006
• CVE-2006-3544 Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.3 Final allow remote attackers to execute arbitrary SQL commands via the CODE parameter iHigh 7.5 · Jul 12, 2006
• CVE-2006-2217 SQL injection vulnerability in index.php in Invision Power Board allows remote attackers to execute arbitrary SQL commands via the pid parameter in a reputationHigh 7.5 · May 5, 2006
• CVE-2006-2097 SQL injection vulnerability in func_msg.php in Invision Power Board (IPB) 2.1.4 allows remote attackers to execute arbitrary SQL commands via the from_contact fHigh 7.5 · Apr 29, 2006
• CVE-2006-1288 Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands viHigh 7.5 · Mar 19, 2006
• CVE-2006-1076 SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board (IPB) 2.1.5 allows remote attackers to execute arbitrarHigh 7.5 · Mar 8, 2006
• CVE-2005-3395 SQL injection vulnerability in Invision Gallery 2.0.3 allows remote attackers to execute arbitrary SQL commands via the st parameter.High 7.5 · Nov 1, 2005
• CVE-2005-1946 Multiple SQL injection vulnerabilities in Invision Blog before 1.1.2 Final allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter toHigh 7.5 · Jun 9, 2005
• CVE-2005-1948 Multiple SQL injection vulnerabilities in Invision Gallery before 1.3.1 allow remote attackers to execute arbitrary SQL commands via (1) the comment parameter iHigh 7.5 · Jun 9, 2005
• CVE-2005-1598 SQL injection vulnerability in Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted cookie passwHigh 7.5 · May 16, 2005
• CVE-2005-0217 SQL injection vulnerability in index.php in Invision Community Blog allows remote attackers to execute arbitrary SQL commands via the eid parameter.High 7.5 · May 2, 2005
• CVE-2005-1070 SQL injection vulnerability in index.php in Invision Power Board 1.3.1 Final and earlier allows remote attackers to execute arbitrary SQL commands via the st paHigh 7.5 · Apr 11, 2005
• CVE-2004-1531 SQL injection vulnerability in post.php in Invision Power Board (IPB) 2.0.0 through 2.0.2 allows remote attackers to execute arbitrary SQL commands via the qpidHigh 7.5 · Dec 31, 2004
• CVE-2004-1835 Multiple SQL injection vulnerabilities in index.php in Invision Gallery 1.0.1 allow remote attackers to execute arbitrary SQL via the (1) img, (2) cat, (3) sortHigh 7.5 · Dec 31, 2004