CVE-2012-2226

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by uploading a malicious file.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/52998Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/74855Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/52998Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/74855Third Party Advisory, VDB Entry

Timeline

Published: Jan 9, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-22277.5Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local CVE-2012-22306.5Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskc CVE-2012-22344.3Cross-site scripting (XSS) vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject a CVE-2012-22354.3Cross-site scripting (XSS) vulnerability in Support Incident Tracker (SiT!) 3.65 and earlier allows remote attackers to inject arbitrary web CVE-2012-22366.5SQL injection vulnerability in users.php in PHP Gift Registry 1.5.5 allows remote authenticated users to execute arbitrary SQL commands via CVE-2012-22376.1Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arb CVE-2012-22387.5trytond 2.4: ModelView.button fails to validate authorization CVE-2012-22399.1Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML extern CVE-2012-22407.5scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to "a CVE-2012-22415.0scripts/dget.pl in devscripts before 2.12.3 allows remote attackers to delete arbitrary files via a crafted (1) .dsc or (2) .changes file, p CVE-2012-22426.8scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes fi CVE-2012-22434.3Cross-site scripting (XSS) vulnerability in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to inject arbitrary web