Invisionpower Invision Power Board vulnerabilities

4 vulnerabilities

Known vulnerabilities in Invisionpower Invision Power Board, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

3.5CVE-2015-6810invisionpowerinvision_power_board
EPSS score
1.35%
Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the event_location[address] array parameter to calendar/submit/.7.5CVE-2014-9239invisioncommunityinvision_power_board+1
EPSS score
1.36%
SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id[] parameter.10CVE-2012-5692invisioncommunityinvision_power_board+1
EPSS score
26.05%
Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors.6.4CVE-2006-0633invisionpowerinvision_power_board
EPSS score
1.20%
The make_password function in ipsclass.php in Invision Power Board (IPB) 2.1.4 uses random data generated from partially predictable seeds to create the authentication code that is sent by e-mail to a user with a lost password, which might make it easier for remote attackers to guess the code and change the password for an IPB account, possibly involving millions of requests.