Description

applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter.

Remediation

References

CVE-2016-6174

Related Vulnerabilities

Trac CVE-2009-4405 Vulnerability (CVE-2009-4405)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-0236)

WordPress Plugin WP Airbnb Review Slider SQL Injection (3.2)

Ruby Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2017-14064)

WordPress Plugin wpShopGermany Free Arbitrary File Upload (4.0.10)

Severity

High

Classification

CVE-2016-6174 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities