Unscored severity · published Sep 4, 2015
CVE-2015-6810
Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the event_location[address] array parameter to calendar/submit/.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Invision Power Board · Invisionpower
4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5.1; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6810
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6810
Vendor Advisory
https://community.invisionpower.com/release-notes/40121-r22/
Exploit
https://www.exploit-db.com/exploits/37989/
More from Invision Power Board
–
CVE-2014-9239
SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before…
–
CVE-2012-5692
Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors
–
CVE-2006-0633
The make_password function in ipsclass.php in Invision Power Board (IPB) 2.1.4 uses random data generated from partially predictable seeds to create the authentication code that…