Medium severity6.1NVD Advisory· Published Aug 17, 2021· Updated Jun 17, 2026

CVE-2021-39249

Description

Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through a brute-force attack against the PHP mt_rand function.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Invision Power Services/Power Board
cpe:2.3:a:invisioncommunity:invision_power_board:*:*:*:*:*:*:*:*
Range: <4.6.5.1
Invision Community/Invision Communitydescription
Invision Community/Invision Communityllm-create
Range: <4.6.5.1
Invision Community/IP-Boardllm-create
Range: <4.6.5.1
Invision Community/IPS Community Suitellm-fuzzy
Range: <4.6.5.1

Patches

Vulnerability mechanics

References

ssd-disclosure.com/ssd-advisory-ip-board-stored-xss-to-rce-chain/nvdExploitThird Party Advisory
invisioncommunity.com/release-notes/4651-r102/nvdRelease NotesVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000