CVE-2007-2349
UnknownEPSS 1.65%
Last modified
CVE-2007-2349 is a vulnerability of currently unknown severity. Cross-site scripting (XSS) vulnerability in Invision Power Board (IP.Board) 2.1.x and 2.2.x allows remote attackers to inject arbitrary web script or HTML by uploading crafted images or PDF files.. EPSS estimates a 1.65% chance of exploitation in the next 30 days.
Description
Cross-site scripting (XSS) vulnerability in Invision Power Board (IP.Board) 2.1.x and 2.2.x allows remote attackers to inject arbitrary web script or HTML by uploading crafted images or PDF files.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Invision Power Services | Invision Power Board | 2.1 |
| Invision Power Services | Invision Power Board | 2.2 |
References
- http://secunia.com/advisories/25021Patch, Vendor Advisory
- http://secunia.com/advisories/25021Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2007-2349?
Cross-site scripting (XSS) vulnerability in Invision Power Board (IP.Board) 2.1.x and 2.2.x allows remote attackers to inject arbitrary web script or HTML by uploading crafted images or PDF files.
How severe is CVE-2007-2349?
Severity scoring for CVE-2007-2349 is pending analysis. The EPSS model estimates a 1.65% probability of exploitation in the next 30 days.
How do I fix CVE-2007-2349?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2007
- CVE-2007-2343Stack-based buffer overflow in the TFTPD component in Entera…
- CVE-2007-2344The BOOTPD component in Enterasys NetSight Console 2.1 and N…
- CVE-2007-2345PHP remote file inclusion vulnerability in include/include_s…
- CVE-2007-2346Multiple PHP remote file inclusion vulnerabilities in PHP-Ge…
- CVE-2007-2347PHP remote file inclusion vulnerability in main/forum/koment…
- CVE-2007-2348mirror --script in lftp before 3.5.9 does not properly quote…
- CVE-2007-2350admin/config.php in the music-on-hold module in freePBX 2.2.…
- CVE-2007-2351Unspecified vulnerability in the HP Power Manager Remote Age…
- CVE-2007-2352Multiple format string vulnerabilities in AFFLIB 2.2.6 allow…
- CVE-2007-2353Apache Axis 1.0 allows remote attackers to obtain sensitive …
- CVE-2007-2354Progress Webspeed Messenger allows remote attackers to obtai…
- CVE-2007-2355The get_url function in DODS_Dispatch.pm for the CGI_server …
Are you affected by CVE-2007-2349?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST