Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

324new WordPress flaws this week

390,007entries in the database

81 results · page 1 of 2

May 16, 2025Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php.CVE-2025-47916 · Other software · invisioncommunity · reported by MITRECritical 10
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record invisioncommunity.com karmainsecurity.com
Aug 17, 2021Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placedCVE-2021-39250 · Other software · Invisioncommunity · reported by MITREMedium 5.4
Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker can rely on the ability of an admin to install widgets, disclosure of the admin session ID in a Referer header, and the ability of an admin to use the templating engine (e.g., Edit HTML).
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record invisioncommunity.com ssd-disclosure.com
Aug 17, 2021Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through CVE-2021-39249 · Other software · Invisioncommunity · reported by MITREMedium 6.1
Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through a brute-force attack against the PHP mt_rand function.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record invisioncommunity.com ssd-disclosure.com
Mar 13, 2020Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment.CVE-2009-5159 · Other software · Invisioncommunity · reported by MITREMedium 6.1
Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.invisionpower.com packetstormsecurity.com
Feb 12, 2020Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution.CVE-2013-3725 · Other software · Invisioncommunity · reported by MITRECritical 9.8
Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record john-jean.com john-jean.com
Jan 9, 2020Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary CVE-2012-2226 · Other software · Invisioncommunity · reported by MITRECritical 9.8
Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by uploading a malicious file.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Mar 1, 2019Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 leads to Remote Code Execution.CVE-2019-8278 · Other software · Kaspersky Lab · reported by vulnerability@kaspersky.comMedium 6.1
Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 leads to Remote Code Execution.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com scriptinjection.blogspot.com
Mar 20, 2018SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parCVE-2014-4928 · Other software · Invisioncommunity · reported by MITREHigh 8.8
SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dringen.blogspot.com.au dringen.blogspot.com.au
May 11, 2017Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature foCVE-2017-8899 · Other software · Invisioncommunity · reported by MITREHigh 8.1
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The primary cause is the ability to upload an SVG document with a crafted attribute such an onload; however, full path disclosure is required for exploitation.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zeroday.insecurity.zone twitter.com
May 11, 2017Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power BoaCVE-2017-8898 · Other software · Invisioncommunity · reported by MITRECritical 9.8
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announce_content parameter in an index.php?/modcp/announcements/&action=create request. This is related to the "<> Source" option.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zeroday.insecurity.zone twitter.com
May 11, 2017Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?conCVE-2017-8897 · Other software · Invisioncommunity · reported by MITREMedium 6.1
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision Power Board user who views the announcement.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zeroday.insecurity.zone twitter.com
Apr 23, 2017Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag.CVE-2016-2564 · Other software · Invisioncommunity · reported by MITREMedium 5.9
Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record invisionpower.com medium.com
Jul 12, 2016applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13,CVE-2016-6174 · Other software · Invisioncommunity · reported by MITREHigh 8.1
applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record karmainsecurity.com lists.apple.com
Sep 4, 2015Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.0.12.1 allows remote attackers to cause a denial of serviceCVE-2015-6812 · Other software · Invisioncommunity · reported by MITREHigh 7.8
Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.0.12.1 allows remote attackers to cause a denial of service (loop and memory consumption) via a crafted URL.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.invisionpower.com community.invisionpower.com
Sep 4, 2015Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 alloCVE-2015-6810 · Other software · Invisionpower · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the event_location[address] array parameter to calendar/submit/.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.invisionpower.com exploit-db.com
Dec 3, 2014SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x throuCVE-2014-9239 · Other software · Invisioncommunity · reported by MITREHigh 7.5
SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id[] parameter.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.invisionpower.com community.invisionpower.com
Jul 28, 2014Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary webCVE-2014-5106 · Other software · Invisioncommunity · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Jul 3, 2014Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IPCVE-2014-3149 · Other software · Invisioncommunity · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.invisionpower.com packetstormsecurity.com
Oct 31, 2012Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack CVE-2012-5692 · Other software · Invisioncommunity · reported by MITREHigh 10
Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.invisionpower.com secunia.com
Sep 16, 2010Cross-site scripting (XSS) vulnerability in admin/sources/classes/bbcode/custom/defaults.php in Invision Power Board (IP.Board) 3.1.2 allows remote attackers toCVE-2010-3424 · Other software · Invisioncommunity · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/sources/classes/bbcode/custom/defaults.php in Invision Power Board (IP.Board) 3.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.invisionpower.com secunia.com
Mar 2, 2010SQL injection vulnerability in index.php in (nv2) Awards 1.1.0, a modification for Invision Power Board, allows remote attackers to execute arbitrary SQL commanCVE-2010-0802 · Other software · Aleinbeen · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in (nv2) Awards 1.1.0, a modification for Invision Power Board, allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action.
Product
(nv2) Awards
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.org secunia.com
Nov 18, 2009Multiple SQL injection vulnerabilities in Invision Power Board (IPB or IP.Board) 3.0.0, 3.0.1, and 3.0.2 allow remote attackers to execute arbitrary SQL commandCVE-2009-3974 · Other software · Invisioncommunity · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Invision Power Board (IPB or IP.Board) 3.0.0, 3.0.1, and 3.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) search_term parameter to admin/applications/core/modules_public/search/search.php and (2) aid parameter to admin/applications/core/modules_public/global/lostpass.php. NOTE: on 20090818, the vendor patched 3.0.2 without changing the version number.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com vupen.com
Mar 31, 2009Cross-site scripting (XSS) vulnerability in Invision Power Board 2.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via an IFRAME CVE-2008-6565 · Other software · Invision Power Services · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Invision Power Board 2.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via an IFRAME tag in the signature.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Sep 22, 2008SQL injection vulnerability in xmlout.php in Invision Power Board (IP.Board or IPB) 2.2.x and 2.3.x allows remote attackers to execute arbitrary SQL commands viCVE-2008-4171 · Other software · Invision Power Services · reported by MITREHigh 7.5
SQL injection vulnerability in xmlout.php in Invision Power Board (IP.Board or IPB) 2.2.x and 2.3.x allows remote attackers to execute arbitrary SQL commands via the name parameter.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com securityfocus.com
Mar 17, 2008Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB or IP.Board) 2.3.4 before 2008-03-13 allows remote attackers to inject arbitrary web scripCVE-2008-1359 · Other software · Invision Power Services · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB or IP.Board) 2.3.4 before 2008-03-13 allows remote attackers to inject arbitrary web script or HTML via nested BBCodes, a different vector than CVE-2008-0913.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com secunia.com
Feb 22, 2008Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB or IP.Board) 2.3.4 allows remote attackers to inject arbitrary web script or HTML via crafCVE-2008-0913 · Other software · Invision Power Services · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB or IP.Board) 2.3.4 allows remote attackers to inject arbitrary web script or HTML via crafted BBCodes in an unspecified context.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com secunia.com
Oct 29, 2007Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision Power Board (IPB or CVE-2007-5688 · Other software · Invision Power Services · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision Power Board (IPB or IP.Board), allow remote attackers to execute arbitrary SQL commands via the (1) go and (2) cat parameters.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com inj3ct-it.org
Sep 17, 2007ips_kernel/class_upload.php in Invision Power Board (IPB or IP.Board) 2.3.1 up to 20070912 allows remote attackers to upload arbitrary script files with craftedCVE-2007-4913 · Other software · Invision Power Services · reported by MITREHigh 7.5
ips_kernel/class_upload.php in Invision Power Board (IPB or IP.Board) 2.3.1 up to 20070912 allows remote attackers to upload arbitrary script files with crafted image filenames to uploads/, where they are saved with a .txt extension and are not executable. NOTE: there are limited usage scenarios under which this would be a vulnerability, but it is being tracked by CVE since the vendor has stated it is security-relevant.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com forums.invisionpower.com
Sep 17, 2007Unspecified vulnerability in the subscriptions manager in Invision Power Board (IPB or IP.Board) 2.3.1 before 20070912 allows remote authenticated users to chanCVE-2007-4914 · Other software · Invision Power Services · reported by MITREMedium 6
Unspecified vulnerability in the subscriptions manager in Invision Power Board (IPB or IP.Board) 2.3.1 before 20070912 allows remote authenticated users to change the member ID and reduce the privilege level of arbitrary users via a crafted payment form, related to (1) class_gw_2checkout.php, (2) class_gw_authorizenet.php, (3) class_gw_nochex.php, (4) class_gw_paypal.php, and (5) class_gw_safshop.php in sources/classes/paymentgateways/.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com forums.invisionpower.com
Sep 17, 2007Cross-site scripting (XSS) vulnerability in ips_kernel/class_ajax.php in Invision Power Board (IPB or IP.Board) 2.3.1 up to 20070912 allows remote attackers to CVE-2007-4912 · Other software · Invision Power Services · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in ips_kernel/class_ajax.php in Invision Power Board (IPB or IP.Board) 2.3.1 up to 20070912 allows remote attackers to inject arbitrary web script or HTML into user profile fields via unspecified vectors related to character sets other than iso-8859-1 or utf-8.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com forums.invisionpower.com
Aug 22, 2007Cross-site scripting (XSS) vulnerability in D22-Shoutbox for Invision Power Board (IPB or IP.Board) allows remote attackers to inject arbitrary web script or HTCVE-2007-4487 · Other software · Dscripting.com · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in D22-Shoutbox for Invision Power Board (IPB or IP.Board) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
D22-shoutbox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityreason.com
Jun 14, 2007Unspecified vulnerability in sources/action_public/xmlout.php in Invision Power Board (IPB or IP.Board) 2.2.0 through 2.2.2 allows remote attackers to modify anCVE-2007-3219 · Other software · Invision Power Services · reported by MITREHigh 7.8
Unspecified vulnerability in sources/action_public/xmlout.php in Invision Power Board (IPB or IP.Board) 2.2.0 through 2.2.2 allows remote attackers to modify another user's profile data, such as an AIM screen name or Yahoo! identity.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com secunia.com
May 31, 2007Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board (IPB or IP.Board) 2.2.2, and possibly earlier, allows remote attackers to inject arbCVE-2007-2963 · Other software · Invision Power Services · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board (IPB or IP.Board) 2.2.2, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via (1) module_bbcodeloader.php, (2) module_div.php, (3) module_email.php, (4) module_image.php, (5) module_link.php, or (6) the editorid parameter to module_table.php in jscripts/folder_rte_files/. NOTE: some details were obtained from third party sources.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com osvdb.org
Apr 30, 2007Cross-site scripting (XSS) vulnerability in Invision Power Board (IP.Board) 2.1.x and 2.2.x allows remote attackers to inject arbitrary web script or HTML by upCVE-2007-2349 · Other software · Invision Power Services · reported by MITREMedium 5.8
Cross-site scripting (XSS) vulnerability in Invision Power Board (IP.Board) 2.1.x and 2.2.x allows remote attackers to inject arbitrary web script or HTML by uploading crafted images or PDF files.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com osvdb.org
Mar 2, 2007SQL injection vulnerability in classes/class_session.php in Invision Power Board (IPB) 2.1 up to 2.1.6 allows remote attackers to execute arbitrary SQL commandsCVE-2006-7071 · Other software · Invision Power Services · reported by MITREHigh 7.5
SQL injection vulnerability in classes/class_session.php in Invision Power Board (IPB) 2.1 up to 2.1.6 allows remote attackers to execute arbitrary SQL commands via the CLIENT_IP parameter.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com rst.void.ru
Feb 23, 2007Cross-site scripting (XSS) vulnerability in forum/admin.php for Invision Power Board (IPB) 2.1.6 and earlier allows remote attackers to inject arbitrary web scrCVE-2006-7064 · Other software · Invision Power Services · reported by MITREHigh 9.3
Cross-site scripting (XSS) vulnerability in forum/admin.php for Invision Power Board (IPB) 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML as the administrator via the phpinfo parameter.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com securityreason.com
Oct 10, 2006Invision Power Board (IPB) 2.1.7 and earlier allows remote restricted administrators to inject arbitrary web script or HTML, or execute arbitrary SQL commands, CVE-2006-5203 · Other software · Invision Power Services · reported by MITREMedium 5.1
Invision Power Board (IPB) 2.1.7 and earlier allows remote restricted administrators to inject arbitrary web script or HTML, or execute arbitrary SQL commands, via a forum description that contains a crafted image with PHP code, which is executed when the user visits the "Manage Forums" link in the Admin control panel.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Oct 10, 2006Cross-site scripting (XSS) vulnerability in action_admin/member.php in Invision Power Board (IPB) 2.1.7 and earlier allows remote authenticated users to inject CVE-2006-5204 · Other software · Invision Power Services · reported by MITRELow 2.1
Cross-site scripting (XSS) vulnerability in action_admin/member.php in Invision Power Board (IPB) 2.1.7 and earlier allows remote authenticated users to inject arbitrary web script or HTML via a reference to a script in the avatar setting, which can be leveraged for a cross-site request forgery (CSRF) attack involving forced SQL execution by an admin.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com secunia.com
Aug 16, 2006Unspecified vulnerability in func_topic_threaded.php (aka threaded view mode) in Invision Power Board (IPB) before 2.1.7 21013.60810.s allows remote attackers tCVE-2006-4155 · Other software · Invision Power Services · reported by MITREHigh 7.5
Unspecified vulnerability in func_topic_threaded.php (aka threaded view mode) in Invision Power Board (IPB) before 2.1.7 21013.60810.s allows remote attackers to "access posts outside the topic."
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com secunia.com
Jul 12, 2006Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.x and 2.x allow remote attackers to execute arbitrary SQL commands via the (1) idcat and CVE-2006-3543 · Other software · Invision Power Services · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.x and 2.x allow remote attackers to execute arbitrary SQL commands via the (1) idcat and (2) code parameters in a ketqua action in index.php; the id parameter in a (3) Attach and (4) ref action in index.php; the CODE parameter in a (5) Profile, (6) Login, and (7) Help action in index.php; and the (8) member_id parameter in coins_list.php. NOTE: the developer has disputed this issue, stating that the "CODE attribute is never present in an SQL query" and the "'ketqua' [action] and file 'coin_list.php' are not standard IPB 2.x features". It is unknown whether these vectors are associated with an independent module or modification of IPB
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreason.com osvdb.org
Jul 12, 2006Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.3 Final allow remote attackers to execute arbitrary SQL commands via the CODE parameter iCVE-2006-3544 · Other software · Invision Power Services · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.3 Final allow remote attackers to execute arbitrary SQL commands via the CODE parameter in a (1) Stats, (2) Mail, and (3) Reg action in index.php. NOTE: the developer has disputed this issue, stating that "At no point does the CODE parameter touch the database. The CODE parameter is used in a SWITCH statement to determine which function to run.
Product
Invision Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreason.com osvdb.org
Jun 22, 2006Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a POCVE-2006-3197 · Other software · Invision Power Services · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a POST that contains hexadecimal-encoded HTML.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com secunia.com
May 19, 2006Invision Power Board (IPB) before 2.1.6 allows remote attackers to execute arbitrary PHP script via attack vectors involving (1) the post_icon variable in classCVE-2006-2498 · Other software · Invision Power Services · reported by MITREMedium 6.4
Invision Power Board (IPB) before 2.1.6 allows remote attackers to execute arbitrary PHP script via attack vectors involving (1) the post_icon variable in classes/post/class_post.php and (2) the df value in action_public/moderate.php.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record attrition.org forums.invisionpower.com
May 5, 2006SQL injection vulnerability in index.php in Invision Power Board allows remote attackers to execute arbitrary SQL commands via the pid parameter in a reputationCVE-2006-2217 · Other software · Invision Power Services · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in Invision Power Board allows remote attackers to execute arbitrary SQL commands via the pid parameter in a reputation action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
May 5, 2006SQL injection vulnerability in the topic deletion functionality (post_delete function in func_mod.php) for Invision Power Board 2.1.5 allows remote authenticateCVE-2006-2204 · Other software · Invision Power Services · reported by MITREMedium 5.5
SQL injection vulnerability in the topic deletion functionality (post_delete function in func_mod.php) for Invision Power Board 2.1.5 allows remote authenticated moderators to execute arbitrary SQL commands via the selectedpids parameter, which bypasses an integer value check when the $id variable is an array.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com secunia.com
Apr 29, 2006SQL injection vulnerability in func_msg.php in Invision Power Board (IPB) 2.1.4 allows remote attackers to execute arbitrary SQL commands via the from_contact fCVE-2006-2097 · Other software · Invision Power Services · reported by MITREHigh 7.5
SQL injection vulnerability in func_msg.php in Invision Power Board (IPB) 2.1.4 allows remote attackers to execute arbitrary SQL commands via the from_contact field in a private message (PM).
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Apr 26, 2006SQL injection vulnerability in lib/func_taskmanager.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitraCVE-2006-2061 · Other software · Invision Power Services · reported by MITREMedium 5
SQL injection vulnerability in lib/func_taskmanager.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary SQL commands via the ck parameter, which can inject at most 32 characters.
Product
Invision Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com secunia.com
Apr 26, 2006action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with aCVE-2006-2059 · Other software · Invision Power Services · reported by MITREMedium 5
action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a "#e" (execute) modifier.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com secunia.com
Apr 26, 2006Directory traversal vulnerability in action_admin/paysubscriptions.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote authenticatedCVE-2006-2060 · Other software · Invision Power Services · reported by MITREMedium 6.4
Directory traversal vulnerability in action_admin/paysubscriptions.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote authenticated administrators to include and execute arbitrary local PHP files via a .. (dot dot) in the name parameter, preceded by enough backspace (%08) characters to erase the initial static portion of a filename.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com secunia.com
Mar 23, 2006Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) 2.1.5 and earlier before 20060308 allows remote attackers to inject arbitrary web script CVE-2006-1369 · Other software · Invision Power Services · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) 2.1.5 and earlier before 20060308 allows remote attackers to inject arbitrary web script or HTML via a Private Message (PM) in certain circumstances.
Product
Invision Power Board
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.invisionpower.com secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.