EIP-2026-107919

PRE-CVE

Invision Power Board (IP.Board) 4.1.4.x - Persistent Cross-Site Scripting

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-107919. PoCs published by Mehdi Alouache.

AI-analyzed exploit summary This is a writeup describing a persistent XSS vulnerability in IP.Board 4.1.4.x, where malicious JavaScript in a private message title executes when the recipient receives a notification. No exploit code is provided, only a description and proof-of-concept steps.

Description

Invision Power Board (IP.Board) 4.1.4.x - Persistent Cross-Site Scripting

Exploits (1)

exploitdb WRITEUP
by Mehdi Alouache · textwebappsphp
https://www.exploit-db.com/exploits/38837

This is a writeup describing a persistent XSS vulnerability in IP.Board 4.1.4.x, where malicious JavaScript in a private message title executes when the recipient receives a notification. No exploit code is provided, only a description and proof-of-concept steps.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: IP.Board 4.1.4.x
Auth required
Prerequisites: Registered user account · Recipient with message notifications enabled
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026