medium4.3Public exploit code
CVE-2005-0477
Cross-site scripting (XSS) vulnerability in the SML code for Invision Power Board 1.3.1 FINAL allows remote attackers to inject arbitrary web script via (1) a …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Invision Power Board (IP.Board) 1.x/2.0.3 - SML Code Script Injection2005-02-21 · webapps · php · Verified
Impact
Cross-site scripting (XSS) vulnerability in the SML code for Invision Power Board 1.3.1 FINAL allows remote attackers to inject arbitrary web script via (1) a signature file or (2) a message post containing an IMG tag within a COLOR tag whose style is set to background:url.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Invision Power Services | Invision Power Board | Versions 1.0, 1.0.1, 1.1.1, 1.1.2, 1.2, 1.3 |