CVE-2025-48933VulnerabilityPublished 23 Jul 2025

[CVE-2025-48933] Invision Community <= 5.0.7 (oauth/callback) Reflected Cross-Site Scripting Vulnerability

Affects communitySource Reddit NetSec

Not known to be exploited.

Data as of 23 Jul 2025, 10:18 UTC

Severity

Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

Exploitation evidence

Disclosed: evidence found.
Public on cve.org; its publication date is not in this record
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Packagistinvision/community`pkg:composer/invision/community`Other threats	Affected <=5.0.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

European organizations should implement the following specific mitigation strategies: 1) Immediate upgrade to the latest Invision Community version once a patch addressing CVE-2025-48933 is released. Monitor official vendor channels and trusted security advisories for patch availability. 2) In the interim, apply web application firewall (WAF) rules tailored to detect and block malicious payloads targeting the oauth/callback endpoint, focusing on common XSS attack patterns. 3) Conduct a thorough review of OAuth callback URL handling and input validation mechanisms within the application, ensuring strict sanitization and encoding of all user-controllable inputs. 4) Implement Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts in browsers accessing the community platform. 5) Educate users about the risks of clicking suspicious links, especially those related to authentication flows, to reduce the likelihood of successful exploitation. 6) Perform regular security assessments and penetration testing focused on authentication endpoints to identify and remediate similar vulnerabilities proactively. 7) Monitor logs for unusual activity around the oauth/callback endpoint, including anomalous query parameters or repeated failed authentication attempts. These targeted actions go beyond generic advice by focusing on the specific vulnerable component and the operational context of European organizations.

Description

[CVE-2025-48933] Invision Community <= 5.0.7 (oauth/callback) Reflected Cross-Site Scripting Vulnerability Source: https://karmainsecurity.com/KIS-2025-05

Impact

For European organizations utilizing Invision Community versions up to 5.0.7, this vulnerability poses a risk primarily to the confidentiality and integrity of user sessions and data. Successful exploitation could allow attackers to steal session cookies, impersonate users, or perform unauthorized actions within the community platform. This could lead to data breaches involving personally identifiable information (PII), disruption of community services, and reputational damage. Organizations relying on Invision Community for customer engagement, internal collaboration, or support forums may experience operational disruptions and loss of user trust. Additionally, attackers could leverage the vulnerability as a foothold for further attacks, such as phishing campaigns or lateral movement within the network. Given the nature of reflected XSS, exploitation requires user interaction, typically by tricking users into clicking malicious links. However, the oauth/callback endpoint's role in authentication flows increases the sensitivity of the attack vector. The impact is compounded in regulated sectors common in Europe, such as finance, healthcare, and public services, where data protection compliance is critical. Failure to address this vulnerability could result in non-compliance with GDPR and other data protection regulations, leading to legal and financial consequences.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 23 Jul 2025, 10:18 UTC

Technical details

References

Community reviews

Related threats