----------------------------------------------------------------------------------------- Invision Community <= 5.0.7 (oauth/callback) Reflected Cross-Site Scripting Vulnerability ----------------------------------------------------------------------------------------- [-] Software Link: https://invisioncommunity.com [-] Affected Versions: Certain 4.x versions before 4.7.21. All 5.x versions before 5.0.8. [-] Vulnerability Description: User input passed through the "state" POST parameter to the /oauth/callback/index.php script is not properly sanitized before being used to generate HTML output. This can be exploited by attackers to perform Reflected Cross-Site Scripting (XSS) attacks. [-] Proof of Concept: The vulnerability can be exploited by tricking a victim user into opening an HTML page like the following: [-] Solution: Upgrade to version 4.7.21, 5.0.8, or later. [-] Disclosure Timeline: [16/05/2025] - Vendor notified [27/05/2025] - Version 4.7.21 released [28/05/2025] - Version 5.0.8 released [28/05/2025] - CVE identifier requested [28/05/2025] - CVE identifier assigned [23/07/2025] - Public disclosure [-] CVE Reference: The Common Vulnerabilities and Exposures program (cve.org) has assigned the name CVE-2025-48933 to this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. [-] Original Advisory: http://karmainsecurity.com/KIS-2025-05