CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-40604
https://notcve.org/view.php?id=CVE-2021-40604
13 Jun 2022 — A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated user. Una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) en IPS Community Suite versiones anteriores a 4.6.2, permite a usuarios remotos autenticados solicitar URLs arbitrarias o desencadenar la deseriali... • https://invisioncommunity.com/release-notes/462-r99 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 6%CPEs: 1EXPL: 4CVE-2021-32924 – IPS Community Suite 4.5.4.2 PHP Code Injection
https://notcve.org/view.php?id=CVE-2021-32924
31 May 2021 — Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\_builder::previewBlock method interacts unsafely with the IPS\_Theme::runProcessFunction method. Invision Community (también se conoce como IPS Community Suite) versiones anteriores a 4.6.0, permite una inyección de código eval-based PHP por parte de un moderador, ya que el método IPS\cms\modules\front\pages\_builder::previewBlock interactúa de forma no segura... • https://packetstorm.news/files/id/162868 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2021-3025 – IPS Community Suite 4.5.4 SQL Injection
https://notcve.org/view.php?id=CVE-2021-3025
06 Jan 2021 — Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the GETindex() method in applications/downloads/api/files.php). Invision Community IPS Community Suite versiones anteriores a 4.5.4.2, permite una inyección SQL por medio de la API REST Downloads (el parámetro sortDir en una acción sortBy=popular para el método GETindex() en el archivo applications/downloads/api/files.php) IPS Community Suite versions 4.5... • https://packetstorm.news/files/id/160830 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3026
https://notcve.org/view.php?id=CVE-2021-3026
05 Jan 2021 — Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment. Invision Community IPS Community Suite versiones anteriores a 4.5.4.2, permite un ataque de tipo XSS durante la cita de una publicación o comentario • https://invisioncommunity.com/release-notes • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •