Invisioncommunity vulnerabilities
We track 3 vulnerabilities in Invisioncommunity products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 16, 2025.
Latest Invisioncommunity vulnerabilities
- 9.8 Critical severity
Invision Power Board: Improper Control of Generation of Code
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named
- 9.8 Critical severity
Invisioncommunity: Improper Neutralization of Special Elements used in an SQL Command
Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryView() method, where user input passed through the filter request parameter is not properly sanitized b
- 7.2 High severity
community: Insufficient Verification of Data Authenticity
Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\_toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the application