Published: 04/09/2015 Updated: 04/09/2015

CVSS v2 Base Score: 3.5 | Impact Score: 2.9 | Exploitability Score: 6.8

VMScore: 355

Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x prior to 4.0.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the event_location[address] array parameter to calendar/submit/.

Vulnerable Product	Search on Vulmon	Subscribe to Product
invisionpower invision power board 4.0.2
invisionpower invision power board 4.0.3
invisionpower invision power board 4.0.4
invisionpower invision power board 4.0.5.1
invisionpower invision power board 4.0.9.2
invisionpower invision power board 4.0.10.2
invisionpower invision power board 4.0.11
invisionpower invision power board 4.0.12
invisionpower invision power board 4.0.0
invisionpower invision power board 4.0.7
invisionpower invision power board 4.0.8.1
invisionpower invision power board 4.0.1
invisionpower invision power board 4.0.6.1
invisionpower invision power board 4.0.8

# Exploit Title: IPBoard 4X Stored XSS # Date: 27-08-2015 # Software Link: wwwinvisionpowercom/ # Exploit Author: snop # Contact: twittercom/rabbitz_org # Website: rabbitzorg # Category: webapps 1 Description A registered or non-registered user can create a calendar event including malicious JavaScript code who will ...

CWE-79 https://www.exploit-db.com/exploits/37989/https://community.invisionpower.com/release-notes/40121-r22/https://nvd.nist.gov https://www.exploit-db.com/exploits/37989/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-6810

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect