CVE-2007-4912

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-09-17 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in ips_kernel/class_ajax.php in Invision Power Board (IPB or IP.Board) 2.3.1 up to 20070912 allows remote attackers to inject arbitrary web script or HTML into user profile fields via unspecified vectors related to character sets other than iso-8859-1 or utf-8.

Affected products

Invision Power Services Invision Power Board: 2.1.5_2006-03-08, 2.1.5_2006-04-25, 2.1.6, 2.2, 2.2.1, 2.2.2

References

http://forums.invisionpower.com/index.php?act=attach&type=post&id=11870
http://forums.invisionpower.com/index.php?showtopic=237075
http://secunia.com/advisories/26788
http://www.securityfocus.com/bid/25656
https://exchange.xforce.ibmcloud.com/vulnerabilities/36589
http://forums.invisionpower.com/index.php?act=attach&type=post&id=11870
http://forums.invisionpower.com/index.php?showtopic=237075
http://secunia.com/advisories/26788
http://www.securityfocus.com/bid/25656
https://exchange.xforce.ibmcloud.com/vulnerabilities/36589

Get alerted when CVE-2007-4912 or the next vulnerability affects your stack