CVE-2025-47916

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.

• CWE-1336
• CWE-94

• https://invisioncommunity.com/release-notes-v5/507-r41/Release Notes
• https://karmainsecurity.com/KIS-2025-02Exploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2025/May/4Mailing List, Third Party Advisory
• https://karmainsecurity.com/KIS-2025-02Exploit, Third Party Advisory

Published

May 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-47910When using http.CrossOriginProtection, the AddInsecureBypass…5.4
• CVE-2025-47911The html.Parse function in golang.org/x/net/html has quadrat…5.3
• CVE-2025-47912The Parse function permits values other than IPv6 addresses …5.3
• CVE-2025-47913SSH clients receiving SSH_AGENT_SUCCESS when expecting a typ…7.5
• CVE-2025-47914SSH Agent servers do not validate the size of messages when …5.3
• CVE-2025-47915Rejected reason: reserved but not needed
• CVE-2025-47917Mbed TLS before 3.6.4 allows a use-after-free in certain sit…9.8
• CVE-2025-4792A vulnerability was found in FreeFloat FTP Server 1.0 and cl…9.8
• CVE-2025-47928Spotipy is a Python library for the Spotify Web API. As of c…9.1
• CVE-2025-47929DumbDrop, a file upload application that provides an interfa…2.1
• CVE-2025-4793A vulnerability was found in PHPGurukul Online Course Regist…9.8
• CVE-2025-47930Zulip is an open-source team chat application. Starting in v…5.3