CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2024-30162 – Invision Community 4.7.16 Remote Code Execution
https://notcve.org/view.php?id=CVE-2024-30162
08 Apr 2024 — Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\_toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the applications/core/interface/ckeditor/ckeditor/plugins/ directory without properly verifying their content. This can be exploited by admin users (with the toolbar_manage permission) to write arbitrary PHP files into that directory, leading to execution of arbitrar... • https://packetstorm.news/files/id/177983 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-40604
https://notcve.org/view.php?id=CVE-2021-40604
13 Jun 2022 — A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated user. Una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) en IPS Community Suite versiones anteriores a 4.6.2, permite a usuarios remotos autenticados solicitar URLs arbitrarias o desencadenar la deseriali... • https://invisioncommunity.com/release-notes/462-r99 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 6%CPEs: 1EXPL: 4CVE-2021-32924 – IPS Community Suite 4.5.4.2 PHP Code Injection
https://notcve.org/view.php?id=CVE-2021-32924
31 May 2021 — Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\_builder::previewBlock method interacts unsafely with the IPS\_Theme::runProcessFunction method. Invision Community (también se conoce como IPS Community Suite) versiones anteriores a 4.6.0, permite una inyección de código eval-based PHP por parte de un moderador, ya que el método IPS\cms\modules\front\pages\_builder::previewBlock interactúa de forma no segura... • https://packetstorm.news/files/id/162868 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2021-3025 – IPS Community Suite 4.5.4 SQL Injection
https://notcve.org/view.php?id=CVE-2021-3025
06 Jan 2021 — Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the GETindex() method in applications/downloads/api/files.php). Invision Community IPS Community Suite versiones anteriores a 4.5.4.2, permite una inyección SQL por medio de la API REST Downloads (el parámetro sortDir en una acción sortBy=popular para el método GETindex() en el archivo applications/downloads/api/files.php) IPS Community Suite versions 4.5... • https://packetstorm.news/files/id/160830 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3026
https://notcve.org/view.php?id=CVE-2021-3026
05 Jan 2021 — Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment. Invision Community IPS Community Suite versiones anteriores a 4.5.4.2, permite un ataque de tipo XSS durante la cita de una publicación o comentario • https://invisioncommunity.com/release-notes • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-29477 – Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2020-29477
30 Dec 2020 — Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS payload in Field Name and each time any user will open that, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload. Invision Community versión 4.5.4, está afectado por una vulnerabilidad de tipo cross-site scripting (XSS) en el campo Field Name. Esta vulnerabilidad puede permitir a un atacante inyectar una carga ... • https://www.exploit-db.com/exploits/49188 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •