Description
Invision Community 5.0.0 至 5.0.7 版本之前，可通过向 themeeditor.php传入精心构造的模板字符串实现远程代码执行。攻击者可以获取服务器权限
InvisionCommunity存在代码注入漏洞(CVE-2025-47916)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-47916
https://github.com/Web3-Serializer/CVE-2025-47916
https://www.exploit-db.com/exploits/52294
https://karmainsecurity.com/KIS-2025-02
https://threatprotect.qualys.com/2025/05/29/invision-community-remote-code-execution-vulnerability-cve-2025-47916/
https://www.cvedetails.com/cve/CVE-2025-47916/
https://invisioncommunity.com/release-notes-v5/507-r41/
http://seclists.org/fulldisclosure/2025/May/4
https://www.sentinelone.com/vulnerability-database/cve-2025-47916/