CVE-2021-3025

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the GETindex() method in applications/downloads/api/files.php).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jan 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-302547.8Possible buffer overflow due to improper input validation in factory calibration and test DIAG command in Snapdragon Auto, Snapdragon Comput CVE-2021-302557.8Possible buffer overflow due to improper input validation in PDM DIAG command in FTM in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn CVE-2021-302567.8Possible stack overflow due to improper validation of camera name length before copying the name in VR Service in Snapdragon Compute, Snapdr CVE-2021-302577.8Possible out of bound read or write in VR service due to lack of validation of DSP selection values in Snapdragon Compute, Snapdragon Connec CVE-2021-302587.8Possible buffer overflow due to improper size calculation of payload received in VR service in Snapdragon Auto, Snapdragon Compute, Snapdrag CVE-2021-302597.8Possible out of bound access due to improper validation of function table entries in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect CVE-2021-30266.1Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment.CVE-2021-302607.8Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extscan hostlist configurat CVE-2021-302617.8Possible integer and heap overflow due to lack of input command size validation while handling beacon template update command from HLOS in S CVE-2021-302627.8Improper validation of a socket state when socket events are being sent to clients can lead to invalid access of memory in Snapdragon Auto, CVE-2021-302637.8Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concurrently in Snapdragon CVE-2021-302646.7Possible use after free due improper validation of reference from call back to internal store table in Snapdragon Auto, Snapdragon Connectiv