CVE-2020-29477

MediumCVSS 4.8

Published: 30/12/2020(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.08%

61th percentile - higher than 61% of all known CVEs

Summary

Invision Community 4.5.4 is affected by a cross-site scripting (XSS) vulnerability in the Field Name field. An attacker can inject a malicious JavaScript payload that executes whenever a user opens that field.

Risk Assessment

The risk involves potential theft of user session cookies, which could lead to account takeover and unauthorized access to the system.

Recommendation

Immediately update Invision Community to the latest available version that includes a fix for the XSS vulnerability.

Original NVD description (English source)

Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS payload in Field Name and each time any user will open that, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.