CVE-2021-32924

Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\_builder::previewBlock method interacts unsafely with the IPS\_Theme::runProcessFunction method.

• CWE-94

• http://karmainsecurity.com/KIS-2021-04Third Party Advisory
• http://packetstormsecurity.com/files/162868/IPS-Community-Suite-4.5.4.2-PHP-Code-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/May/80Exploit, Mailing List, Third Party Advisory
• https://hackerone.com/reports/1092574Exploit, Issue Tracking, Third Party Advisory
• https://invisioncommunity.com/features/security/Vendor Advisory
• http://karmainsecurity.com/KIS-2021-04Third Party Advisory
• http://packetstormsecurity.com/files/162868/IPS-Community-Suite-4.5.4.2-PHP-Code-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/May/80Exploit, Mailing List, Third Party Advisory
• https://hackerone.com/reports/1092574Exploit, Issue Tracking, Third Party Advisory
• https://invisioncommunity.com/features/security/Vendor Advisory

Published

Jun 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32917An issue was discovered in Prosody before 0.11.9. The proxy6…5.3
• CVE-2021-32918An issue was discovered in Prosody before 0.11.9. Default se…7.5
• CVE-2021-32919An issue was discovered in Prosody before 0.11.9. The undocu…7.5
• CVE-2021-32920Prosody before 0.11.9 allows Uncontrolled CPU Consumption vi…7.5
• CVE-2021-32921An issue was discovered in Prosody before 0.11.9. It does no…5.9
• CVE-2021-32923HashiCorp Vault and Vault Enterprise allowed the renewal of …7.4
• CVE-2021-32925admin/user_import.php in Chamilo 1.11.x reads XML data witho…6.5
• CVE-2021-32926When an authenticated password change request takes place, t…7.5
• CVE-2021-32927An attacker may be able to inject client-side JavaScript cod…6.1
• CVE-2021-32928The Sentinel LDK Run-Time Environment installer (Versions 7.…9.8
• CVE-2021-32929All versions of Uffizio GPS Tracker may allow an attacker to…8.8
• CVE-2021-3293emlog v5.3.1 has full path disclosure vulnerability in t/ind…5.3