CVE-2007-4914

no score yetEPSS 1.4%

Unspecified vulnerability in the subscriptions manager in Invision Power Board (IPB or IP.Board) 2.3.1 before 20070912 allows remote authenticated users to change the member ID and reduce the privilege level of arbitrary users via a crafted payment form, related to (1) class_gw_2checkout.php, (2) class_gw_authorizenet.php, (3) class_gw_nochex.php, (4) class_gw_paypal.php, and (5) class_gw_safshop.php in sources/classes/paymentgateways/.

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2007-09-17
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

invision_power_services:invision_power_board

References

http://forums.invisionpower.com/index.php?act=attach&type=post&id=11870
http://forums.invisionpower.com/index.php?showtopic=237075
http://osvdb.org/41319
http://osvdb.org/41320
http://osvdb.org/41321

Check your stack JSON