CVE-2006-1288
highpriority · track · 30EPSS 0.012 · 67 %ileEUUSEPSS · scored 2026-10-28
Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to (1) arrays of id/stamp pairs and (2) the keys in arrays of key/value pairs in ipsclass.php; (3) the topics variable in usercp.php; and the topicsread cookie in (4) topics.php, (5) search.php, and (6) forums.php.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.4–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
- invision power services invision power board= 2.0.4nvdUScpe:2.3:a:invision_power_services:invision_power_board:*:*:*:*:*:*:*:*
- invision power services invision power board= 2.1.4nvdUScpe:2.3:a:invision_power_services:invision_power_board:*:*:*:*:*:*:*:*
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- http://forums.invisionpower.com/index.php?act=Attach&type=post&id=9642enisa_euvd
- http://forums.invisionpower.com/index.php?showtopic=204627enisa_euvd
- http://secunia.com/advisories/19141enisa_euvd
- http://www.vupen.com/english/advisories/2006/0861enisa_euvd
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25100enisa_euvd
- http://forums.invisionpower.com/index.php?act=Attach&type=post&id=9642Patchnvd
- http://forums.invisionpower.com/index.php?showtopic=204627Patchnvd
- http://secunia.com/advisories/19141nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan