Vulnerability Details CVE-2021-3025
Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the GETindex() method in applications/downloads/api/files.php).
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 64.2%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
References
Products affected by CVE-2021-3025
-
cpe:2.3:a:invisioncommunity:ips_community_suite:4.5.2
-
cpe:2.3:a:invisioncommunity:ips_community_suite:4.5.3
-
cpe:2.3:a:invisioncommunity:ips_community_suite:4.5.4