Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: invisioncommunity Component: Ips Community Suite Clear all filters
TI-2021-17607 CVE-2021-40604 · GHSA-cg2x-qc59-j254

A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2…

Priority MEDIUM 42

A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01261 Published 2022-06-13 No fix listed CWE-918
TI-2021-12533 CVE-2021-32924 · GHSA-3v82-hq57-c7xh

Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code…

Priority MEDIUM 57

Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\_builder::previewBlock method interacts unsafely with the IPS\_Theme::…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.19908 Published 2021-06-01 No fix listed CWE-94
TI-2021-02163 CVE-2021-3025 · GHSA-fgc3-w3gg-xj3f

Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the…

Priority MEDIUM 41

Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the GETindex() method in applications/downloads/api/files.php).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01425 Published 2021-01-08 No fix listed CWE-89