PT-2025-30554 · Invision Power Systems · Invision Community

Published 2025-07-23 · Updated 2025-11-15 · CVE-2025-48932

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Invision Community versions prior to 4.7.20

Description The Invision Community software contains a SQL injection issue in the calendar/view.php file. The vulnerability resides in the IPScalendarmodulesfrontcalendarview::search() method, where user input from the location request parameter is not properly sanitized before being used in a SQL query at line 743. Successful exploitation requires the “calendar” application to be installed and a “GeoLocation feature” to be configured.

Recommendations Update Invision Community to a version newer than 4.7.20.

Exploit

Related Identifiers

CVE-2025-48932

Affected Products

Invision Community

References · 8

• 🔥 https://exploit-db.com/exploits/52383 · Exploit
• https://twitter.com/_r_netsec/status/1947963172184600943 · Twitter Post
• https://twitter.com/akaclandestine/status/1989613048001167469 · Twitter Post
• https://twitter.com/secharvesterx/status/1947990149196894444 · Twitter Post
• https://t.me/defcon_news/131146 · Telegram Post
• https://t.me/RNetsec/21810 · Telegram Post
• https://t.me/rnetsec/21810 · Telegram Post
• https://t.me/secharvester/19678 · Telegram Post