Invision Community develops a focused line of community-forum and social-networking software that, despite a narrow product portfolio, operates across many self-hosted and managed deployments worldwide. Vulnerabilities affecting the vendor skew toward serious outcomes, with a notable share reaching critical severity and frequently acquiring public exploit code, reflecting the web-application attack surface inherent to user-generated-content platforms. The exposure recurs across flagship products such as Invision Power Board and the IPS Community Suite through web-layer weakness classes including cross-site scripting, SQL injection, code injection, and cross-site request forgery—issues endemic to forum software that processes and renders untrusted user input at scale. Defenders should treat this vendor's security advisories as high-priority for any internet-exposed community installations and maintain a structured patching cadence; current exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Invisioncommunity over time
Signals from CVEs in this vendor scope (27 CVEs).
27 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-47916CRITICAL Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applica | May 16, 2025 | 9.8 | 91 | NO | YES |
CVE-2012-5692HIGH Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors. | Oct 31, 2012 | 10.0 | 64 | NO | YES |
CVE-2024-30163CRITICAL Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryView() method, where us | Jun 7, 2024 | 9.8 | 44 | NO | YES |
CVE-2012-2226CRITICAL Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by uploading a | Jan 9, 2020 | 9.8 | 44 | NO | YES |
CVE-2016-6174HIGH applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP | Jul 12, 2016 | 8.1 | 42 | NO | YES |
CVE-2021-32924HIGH Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\_builder::previewBlock method | Jun 1, 2021 | 8.8 | 34 | NO | NO |
CVE-2017-8898CRITICAL Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an a | May 11, 2017 | 9.8 | 32 | NO | NO |
CVE-2021-40604CRITICAL A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via ph | Jun 13, 2022 | 9.1 | 28 | NO | NO |
CVE-2020-29477MEDIUM Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS payload in Field Name and eac | Dec 30, 2020 | 4.8 | 28 | NO | YES |
CVE-2017-8899HIGH Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This | May 11, 2017 | 8.1 | 27 | NO | NO |
Signals from CVEs in this vendor scope (27 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Invisioncommunity.
Media articles that mention a CVE ID that affects a product developed by Invisioncommunity — matched by CVE ID, not by vendor name.