VendorsInvision Power Servicesinvision_community_blogall versions
Vulnerabilities

Invision Power Services Invision Community Blog

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

5CVEs
CVE-2005-0217
SQL injection vulnerability in index.php in Invision Community Blog allows remote attackers to execute arbitrary SQL commands via the eid parameter.
Published 2005-02-06 · Modified
7.5EPSS 0.013
CVE-2005-1946
Multiple SQL injection vulnerabilities in Invision Blog before 1.1.2 Final allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to an editentry, replyentry, or editcomment action, or (2) the mid parameter to an aboutme action.
Published 2005-06-14 · Modified
7.5EPSS 0.013
CVE-2006-6369
SQL injection vulnerability in lib/entry_reply_entry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when accessed through the "Preview message" functionality.
Published 2006-12-07 · Modified
7.51 PoCEPSS 0.011
CVE-2006-2251
SQL injection vulnerability in the do_mmod function in mod.php in Invision Community Blog (ICB) 1.1.2 final through 1.2 allows remote attackers with moderator privileges to execute arbitrary SQL commands via the selectedbids parameter.
Published 2006-05-09 · Modified
6.4EPSS 0.014
CVE-2005-1945
Cross-site scripting (XSS) vulnerability in the convert_highlite_words function in Invision Blog before 1.1.2 Final allows remote attackers to inject arbitrary web script or HTML via double hex encoded highlight data.
Published 2005-06-14 · Modified
4.3EPSS 0.012