Vendor CVEs
Invision Power Services
All CVEs
119 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-8898 | Cri | 0.64 | 9.8 | 0.02 | May 11, 2017 | Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announce_content parameter in an index.php?/modcp/announcements/&action=cre… | ||
| CVE-2014-4928 | Hig | 0.57 | 8.8 | 0.01 | Mar 20, 2018 | SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter. | ||
| CVE-2016-6174 | Hig | 0.57 | 8.1 | 0.12 | Jul 12, 2016 | applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the… | ||
| CVE-2017-8899 | Hig | 0.53 | 8.1 | 0.01 | May 11, 2017 | Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to… | ||
| CVE-2024-30162 | Hig | 0.47 | 7.2 | 0.01 | Jun 7, 2024 | Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\_toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the… | ||
| CVE-2017-8897 | Med | 0.40 | 6.1 | 0.01 | May 11, 2017 | Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement… | ||
| CVE-2016-2564 | Med | 0.38 | 5.9 | 0.01 | Apr 23, 2017 | Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation. | ||
| CVE-2005-1947 | Med | 0.28 | 4.3 | 0.00 | Jun 9, 2005 | Cross-site request forgery (CSRF) vulnerability in Invision Gallery before 1.3.1 allows remote attackers to delete albums and images as another user via a link or IMG tag to the (1) albums or (2) delimg actions. | ||
| CVE-2025-47916 | 0.10 | — | 0.79 | May 16, 2025 | Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be… | |||
| CVE-2012-5692 | 0.05 | — | 0.25 | Oct 31, 2012 | Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors. | |||
| CVE-2024-30163 | 0.04 | — | 0.09 | Jun 7, 2024 | Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryView() method, where user input passed through the filter request parameter is not properly sanitized before being used to… | |||
| CVE-2006-2059 | 0.04 | — | 0.08 | Apr 26, 2006 | action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a "#e" (execute)… | |||
| CVE-2006-0888 | 0.04 | — | 0.08 | Feb 25, 2006 | index.php in Invision Power Board (IPB) 2.0.1, with Code Confirmation disabled, allows remote attackers to cause an unspecified denial of service by registering a large number of users. | |||
| CVE-2005-1598 | 0.04 | — | 0.14 | May 16, 2005 | SQL injection vulnerability in Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted cookie password hash (pass_hash) that modifies the internal $pid variable. | |||
| CVE-2015-6810 | 0.03 | — | 0.01 | Sep 4, 2015 | Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the event_location[address] array parameter to… | |||
| CVE-2010-3601 | 0.03 | — | 0.01 | Sep 24, 2010 | SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img parameter. | |||
| CVE-2008-6565 | 0.03 | — | 0.01 | Mar 31, 2009 | Cross-site scripting (XSS) vulnerability in Invision Power Board 2.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via an IFRAME tag in the signature. | |||
| CVE-2008-0421 | 0.03 | — | 0.01 | Jan 23, 2008 | SQL injection vulnerability in Invision Gallery 2.0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the album parameter in a rate command. | |||
| CVE-2007-5688 | 0.03 | — | 0.01 | Oct 29, 2007 | Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision Power Board (IPB or IP.Board), allow remote attackers to execute arbitrary SQL commands via the (1) go and (2) cat parameters. | |||
| CVE-2006-7071 | 0.03 | — | 0.01 | Mar 2, 2007 | SQL injection vulnerability in classes/class_session.php in Invision Power Board (IPB) 2.1 up to 2.1.6 allows remote attackers to execute arbitrary SQL commands via the CLIENT_IP parameter. | |||
| CVE-2006-6369 | 0.03 | — | 0.01 | Dec 7, 2006 | SQL injection vulnerability in lib/entry_reply_entry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when accessed through the "Preview message" functionality. | |||
| CVE-2006-5205 | 0.03 | — | 0.03 | Oct 10, 2006 | Directory traversal vulnerability in Invision Gallery 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the dir parameter in (1) index.php and (2) forum/index.php, when the viewimage command in the gallery module is used. | |||
| CVE-2006-5206 | 0.03 | — | 0.01 | Oct 10, 2006 | SQL injection vulnerability in Invision Gallery 2.0.7 allows remote attackers to execute arbitrary SQL commands via the album parameter in (1) index.php and (2) forum/index.php, when the rate command in the gallery automodule is used. | |||
| CVE-2006-3543 | 0.03 | — | 0.01 | Jul 13, 2006 | Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.x and 2.x allow remote attackers to execute arbitrary SQL commands via the (1) idcat and (2) code parameters in a ketqua action in index.php; the id parameter in a (3) Attach and (4) ref action in index.php;… | |||
| CVE-2006-2217 | 0.03 | — | 0.01 | May 5, 2006 | SQL injection vulnerability in index.php in Invision Power Board allows remote attackers to execute arbitrary SQL commands via the pid parameter in a reputation action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party… | |||
| CVE-2006-2097 | 0.03 | — | 0.01 | Apr 29, 2006 | SQL injection vulnerability in func_msg.php in Invision Power Board (IPB) 2.1.4 allows remote attackers to execute arbitrary SQL commands via the from_contact field in a private message (PM). | |||
| CVE-2006-2061 | 0.03 | — | 0.02 | Apr 26, 2006 | SQL injection vulnerability in lib/func_taskmanager.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary SQL commands via the ck parameter, which can inject at most 32 characters. | |||
| CVE-2006-1326 | 0.03 | — | 0.02 | Mar 21, 2006 | Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board 2.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) result_type, (2) search_in, (3) nav, (4) forums, and (5) s parameters in the Search action to index.php; (6) st parameter… | |||
| CVE-2006-1076 | 0.03 | — | 0.01 | Mar 9, 2006 | SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board (IPB) 2.1.5 allows remote attackers to execute arbitrary SQL commands via the st parameter. | |||
| CVE-2005-3547 | 0.03 | — | 0.03 | Nov 16, 2005 | Cross-site scripting (XSS) vulnerability in Invision Power Board 2.1 allows remote attackers to inject arbitrary web script or HTML via the (1) adsess, (2) name, and (3) description parameters in admin.php, and the (4) ACP Notes, (5) Member Name, (6) Password, (7) Email Address,… | |||
| CVE-2005-3395 | 0.03 | — | 0.03 | Nov 1, 2005 | SQL injection vulnerability in Invision Gallery 2.0.3 allows remote attackers to execute arbitrary SQL commands via the st parameter. | |||
| CVE-2005-2542 | 0.03 | — | 0.02 | Aug 10, 2005 | Invision Power Board (IPB) 1.0.3 allows remote attackers to inject arbitrary web script or HTML via an attachment, which is automatically downloaded and processed as HTML. | |||
| CVE-2005-1948 | 0.03 | — | 0.01 | Jun 9, 2005 | Multiple SQL injection vulnerabilities in Invision Gallery before 1.3.1 allow remote attackers to execute arbitrary SQL commands via (1) the comment parameter in an editcomment action or (2) the rating parameter when voting on a photo. | |||
| CVE-2005-1817 | 0.03 | — | 0.02 | Jun 1, 2005 | Invision Power Board (IPB) 1.0 through 1.3 allows remote attackers to edit arbitrary forum posts via a direct request to index.php with modified parameters. | |||
| CVE-2005-1597 | 0.03 | — | 0.02 | May 16, 2005 | Cross-site scripting (XSS) vulnerability in (1) search.php and (2) topics.php for Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the highlite parameter. | |||
| CVE-2005-0886 | 0.03 | — | 0.01 | May 2, 2005 | Cross-site scripting (XSS) vulnerability in Invision Power Board 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an HTTP POST request. | |||
| CVE-2005-1070 | 0.03 | — | 0.01 | Apr 11, 2005 | SQL injection vulnerability in index.php in Invision Power Board 1.3.1 Final and earlier allows remote attackers to execute arbitrary SQL commands via the st parameter. | |||
| CVE-2005-0477 | 0.03 | — | 0.02 | Mar 30, 2005 | Cross-site scripting (XSS) vulnerability in the SML code for Invision Power Board 1.3.1 FINAL allows remote attackers to inject arbitrary web script via (1) a signature file or (2) a message post containing an IMG tag within a COLOR tag whose style is set to background:url. | |||
| CVE-2004-1836 | 0.03 | — | 0.04 | Dec 31, 2004 | SQL injection vulnerability in index.php in Invision Power Top Site List 1.1 RC 2 and earlier allows remote attackers to execute arbitrary SQL via the id parameter of the comments action. | |||
| CVE-2004-1531 | 0.03 | — | 0.01 | Dec 31, 2004 | SQL injection vulnerability in post.php in Invision Power Board (IPB) 2.0.0 through 2.0.2 allows remote attackers to execute arbitrary SQL commands via the qpid parameter. | |||
| CVE-2004-1835 | 0.03 | — | 0.05 | Dec 31, 2004 | Multiple SQL injection vulnerabilities in index.php in Invision Gallery 1.0.1 allow remote attackers to execute arbitrary SQL via the (1) img, (2) cat, (3) sort_key, (4) order_key, (5) user, or (6) album parameters. | |||
| CVE-2004-1536 | 0.03 | — | 0.02 | Dec 31, 2004 | SQL injection vulnerability in index.php in the ibProArcade module for Invision Power Board (IPB) 1.x and 2.x allows remote attackers to execute arbitrary SQL commands via the cat parameter. | |||
| CVE-2003-1385 | 0.03 | — | 0.04 | Dec 31, 2003 | ipchat.php in Invision Power Board 1.1.1 allows remote attackers to execute arbitrary PHP code, if register_globals is enabled, by modifying the root_path parameter to reference a URL on a remote web server that contains the code. | |||
| CVE-2023-52376 | 0.00 | — | 0.00 | Feb 18, 2024 | Information management vulnerability in the Gallery module.Successful exploitation of this vulnerability may affect service confidentiality. | |||
| CVE-2024-20827 | 0.00 | — | 0.00 | Feb 6, 2024 | Improper access control vulnerability in Samsung Gallery prior to version 14.5.04.4 allows physical attackers to access the picture using physical keyboard on the lockscreen. | |||
| CVE-2023-30725 | 0.00 | — | 0.00 | Sep 6, 2023 | Improper authentication in LocalProvier of Gallery prior to version 14.5.01.2 allows attacker to access the data in content provider. | |||
| CVE-2023-30724 | 0.00 | — | 0.00 | Sep 6, 2023 | Improper authentication in GallerySearchProvider of Gallery prior to version 14.5.01.2 allows attacker to access search history. | |||
| CVE-2022-48513 | 0.00 | — | 0.00 | Jul 6, 2023 | Vulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerability may cause out-of-bounds access. | |||
| CVE-2023-31225 | 0.00 | — | 0.00 | May 26, 2023 | The Gallery app has the risk of hijacking attacks. Successful exploitation of this vulnerability may cause download failures and affect product availability. | |||
| CVE-2022-33706 | 0.00 | — | 0.00 | Jul 11, 2022 | Improper access control vulnerability in Samsung Gallery prior to version 13.1.05.8 allows physical attackers to access the pictures using S Pen air gesture. |
- risk 0.64cvss 9.8epss 0.02
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announce_content parameter in an index.php?/modcp/announcements/&action=cre…
- risk 0.57cvss 8.8epss 0.01
SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter.
- risk 0.57cvss 8.1epss 0.12
applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the…
- risk 0.53cvss 8.1epss 0.01
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to…
- risk 0.47cvss 7.2epss 0.01
Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\_toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the…
- risk 0.40cvss 6.1epss 0.01
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement…
- risk 0.38cvss 5.9epss 0.01
Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation.
- risk 0.28cvss 4.3epss 0.00
Cross-site request forgery (CSRF) vulnerability in Invision Gallery before 1.3.1 allows remote attackers to delete albums and images as another user via a link or IMG tag to the (1) albums or (2) delimg actions.
- CVE-2025-47916May 16, 2025risk 0.10cvss —epss 0.79
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be…
- CVE-2012-5692Oct 31, 2012risk 0.05cvss —epss 0.25
Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors.
- CVE-2024-30163Jun 7, 2024risk 0.04cvss —epss 0.09
Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryView() method, where user input passed through the filter request parameter is not properly sanitized before being used to…
- CVE-2006-2059Apr 26, 2006risk 0.04cvss —epss 0.08
action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a "#e" (execute)…
- CVE-2006-0888Feb 25, 2006risk 0.04cvss —epss 0.08
index.php in Invision Power Board (IPB) 2.0.1, with Code Confirmation disabled, allows remote attackers to cause an unspecified denial of service by registering a large number of users.
- CVE-2005-1598May 16, 2005risk 0.04cvss —epss 0.14
SQL injection vulnerability in Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted cookie password hash (pass_hash) that modifies the internal $pid variable.
- CVE-2015-6810Sep 4, 2015risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the event_location[address] array parameter to…
- CVE-2010-3601Sep 24, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img parameter.
- CVE-2008-6565Mar 31, 2009risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Invision Power Board 2.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via an IFRAME tag in the signature.
- CVE-2008-0421Jan 23, 2008risk 0.03cvss —epss 0.01
SQL injection vulnerability in Invision Gallery 2.0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the album parameter in a rate command.
- CVE-2007-5688Oct 29, 2007risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision Power Board (IPB or IP.Board), allow remote attackers to execute arbitrary SQL commands via the (1) go and (2) cat parameters.
- CVE-2006-7071Mar 2, 2007risk 0.03cvss —epss 0.01
SQL injection vulnerability in classes/class_session.php in Invision Power Board (IPB) 2.1 up to 2.1.6 allows remote attackers to execute arbitrary SQL commands via the CLIENT_IP parameter.
- CVE-2006-6369Dec 7, 2006risk 0.03cvss —epss 0.01
SQL injection vulnerability in lib/entry_reply_entry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when accessed through the "Preview message" functionality.
- CVE-2006-5205Oct 10, 2006risk 0.03cvss —epss 0.03
Directory traversal vulnerability in Invision Gallery 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the dir parameter in (1) index.php and (2) forum/index.php, when the viewimage command in the gallery module is used.
- CVE-2006-5206Oct 10, 2006risk 0.03cvss —epss 0.01
SQL injection vulnerability in Invision Gallery 2.0.7 allows remote attackers to execute arbitrary SQL commands via the album parameter in (1) index.php and (2) forum/index.php, when the rate command in the gallery automodule is used.
- CVE-2006-3543Jul 13, 2006risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.x and 2.x allow remote attackers to execute arbitrary SQL commands via the (1) idcat and (2) code parameters in a ketqua action in index.php; the id parameter in a (3) Attach and (4) ref action in index.php;…
- CVE-2006-2217May 5, 2006risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in Invision Power Board allows remote attackers to execute arbitrary SQL commands via the pid parameter in a reputation action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…
- CVE-2006-2097Apr 29, 2006risk 0.03cvss —epss 0.01
SQL injection vulnerability in func_msg.php in Invision Power Board (IPB) 2.1.4 allows remote attackers to execute arbitrary SQL commands via the from_contact field in a private message (PM).
- CVE-2006-2061Apr 26, 2006risk 0.03cvss —epss 0.02
SQL injection vulnerability in lib/func_taskmanager.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary SQL commands via the ck parameter, which can inject at most 32 characters.
- CVE-2006-1326Mar 21, 2006risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board 2.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) result_type, (2) search_in, (3) nav, (4) forums, and (5) s parameters in the Search action to index.php; (6) st parameter…
- CVE-2006-1076Mar 9, 2006risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board (IPB) 2.1.5 allows remote attackers to execute arbitrary SQL commands via the st parameter.
- CVE-2005-3547Nov 16, 2005risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in Invision Power Board 2.1 allows remote attackers to inject arbitrary web script or HTML via the (1) adsess, (2) name, and (3) description parameters in admin.php, and the (4) ACP Notes, (5) Member Name, (6) Password, (7) Email Address,…
- CVE-2005-3395Nov 1, 2005risk 0.03cvss —epss 0.03
SQL injection vulnerability in Invision Gallery 2.0.3 allows remote attackers to execute arbitrary SQL commands via the st parameter.
- CVE-2005-2542Aug 10, 2005risk 0.03cvss —epss 0.02
Invision Power Board (IPB) 1.0.3 allows remote attackers to inject arbitrary web script or HTML via an attachment, which is automatically downloaded and processed as HTML.
- CVE-2005-1948Jun 9, 2005risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in Invision Gallery before 1.3.1 allow remote attackers to execute arbitrary SQL commands via (1) the comment parameter in an editcomment action or (2) the rating parameter when voting on a photo.
- CVE-2005-1817Jun 1, 2005risk 0.03cvss —epss 0.02
Invision Power Board (IPB) 1.0 through 1.3 allows remote attackers to edit arbitrary forum posts via a direct request to index.php with modified parameters.
- CVE-2005-1597May 16, 2005risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in (1) search.php and (2) topics.php for Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the highlite parameter.
- CVE-2005-0886May 2, 2005risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Invision Power Board 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an HTTP POST request.
- CVE-2005-1070Apr 11, 2005risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in Invision Power Board 1.3.1 Final and earlier allows remote attackers to execute arbitrary SQL commands via the st parameter.
- CVE-2005-0477Mar 30, 2005risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the SML code for Invision Power Board 1.3.1 FINAL allows remote attackers to inject arbitrary web script via (1) a signature file or (2) a message post containing an IMG tag within a COLOR tag whose style is set to background:url.
- CVE-2004-1836Dec 31, 2004risk 0.03cvss —epss 0.04
SQL injection vulnerability in index.php in Invision Power Top Site List 1.1 RC 2 and earlier allows remote attackers to execute arbitrary SQL via the id parameter of the comments action.
- CVE-2004-1531Dec 31, 2004risk 0.03cvss —epss 0.01
SQL injection vulnerability in post.php in Invision Power Board (IPB) 2.0.0 through 2.0.2 allows remote attackers to execute arbitrary SQL commands via the qpid parameter.
- CVE-2004-1835Dec 31, 2004risk 0.03cvss —epss 0.05
Multiple SQL injection vulnerabilities in index.php in Invision Gallery 1.0.1 allow remote attackers to execute arbitrary SQL via the (1) img, (2) cat, (3) sort_key, (4) order_key, (5) user, or (6) album parameters.
- CVE-2004-1536Dec 31, 2004risk 0.03cvss —epss 0.02
SQL injection vulnerability in index.php in the ibProArcade module for Invision Power Board (IPB) 1.x and 2.x allows remote attackers to execute arbitrary SQL commands via the cat parameter.
- CVE-2003-1385Dec 31, 2003risk 0.03cvss —epss 0.04
ipchat.php in Invision Power Board 1.1.1 allows remote attackers to execute arbitrary PHP code, if register_globals is enabled, by modifying the root_path parameter to reference a URL on a remote web server that contains the code.
- CVE-2023-52376Feb 18, 2024risk 0.00cvss —epss 0.00
Information management vulnerability in the Gallery module.Successful exploitation of this vulnerability may affect service confidentiality.
- CVE-2024-20827Feb 6, 2024risk 0.00cvss —epss 0.00
Improper access control vulnerability in Samsung Gallery prior to version 14.5.04.4 allows physical attackers to access the picture using physical keyboard on the lockscreen.
- CVE-2023-30725Sep 6, 2023risk 0.00cvss —epss 0.00
Improper authentication in LocalProvier of Gallery prior to version 14.5.01.2 allows attacker to access the data in content provider.
- CVE-2023-30724Sep 6, 2023risk 0.00cvss —epss 0.00
Improper authentication in GallerySearchProvider of Gallery prior to version 14.5.01.2 allows attacker to access search history.
- CVE-2022-48513Jul 6, 2023risk 0.00cvss —epss 0.00
Vulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerability may cause out-of-bounds access.
- CVE-2023-31225May 26, 2023risk 0.00cvss —epss 0.00
The Gallery app has the risk of hijacking attacks. Successful exploitation of this vulnerability may cause download failures and affect product availability.
- CVE-2022-33706Jul 11, 2022risk 0.00cvss —epss 0.00
Improper access control vulnerability in Samsung Gallery prior to version 13.1.05.8 allows physical attackers to access the pictures using S Pen air gesture.
Page 1 of 3