Invisionpower develops a narrow product line centered around community and content-management platforms, with vulnerabilities concentrated in products such as Invision Power Board, IP.Nexus, and IBPhotoHost that are widely deployed across web-based communities. The durable exposure pattern reflects the product portfolio's role in user-facing web applications: vulnerabilities recur through input-handling and authentication weaknesses including cross-site scripting, SQL injection, and improper authentication that are characteristic of web applications processing untrusted content and managing session state. Current severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Invisionpower over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-5692HIGH Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors. | Oct 31, 2012 | 10.0 | 64 | NO | YES |
CVE-2010-3601HIGH SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img parameter. | Sep 24, 2010 | 7.5 | 31 | NO | YES |
CVE-2014-9239HIGH SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before 2014 | Dec 3, 2014 | 7.5 | 21 | NO | NO |
Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote authentica | Sep 4, 2015 | 3.5 | 19 | NO | YES |
CVE-2014-3149MEDIUM Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through | Jul 3, 2014 | 4.3 | 18 | NO | NO |
CVE-2006-0633MEDIUM The make_password function in ipsclass.php in Invision Power Board (IPB) 2.1.4 uses random data generated from partially predictable seeds to create the authentication code that is | Feb 10, 2006 | 6.4 | 17 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Invisionpower.
Media articles that mention a CVE ID that affects a product developed by Invisionpower — matched by CVE ID, not by vendor name.