Unscored severity · published Jul 28, 2014
CVE-2014-5106
Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Invision Power Board · Invisioncommunity
3.4.0; 3.4.0; 3.4.0; 3.4.0; 3.4.0; 3.4.0; +7 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5106
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5106
www.securityfocus.com
http://www.securityfocus.com/archive/1/532822/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/68705
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/94693
More from Invision Power Board
9.8
CVE-2013-3725
Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution
9.8
CVE-2012-2226
Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by uploading a…
9.8
CVE-2017-8898
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an…
8.8
CVE-2014-4928
SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter
8.1
CVE-2017-8899
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP