QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2017-8898

Back to search

CVE-2017-8898

Published: May 11, 2017

Modified: Sep 17, 2024

PUBLISHED

Description

Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announce_content parameter in an index.php?/modcp/announcements/&action=create request. This is related to the "<> Source" option.

VendorProductVersions

n/a

n/a

affected
n/a

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now