CVE-2016-2564: Invisioncommunity Invision Power Board

Medium severity, CVSS 5.9. EPSS: 1.3% chance of exploitation in the next 30 days.

Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation.

Affected products

• Invisioncommunity Invision Power Board: up to and including 4.1.8.1

Published 2017-04-23. Last modified 2026-06-17.