EIP-2026-107933

PRE-CVE

Invision Power Board 2.3.6/3.0.4 - Local File Inclusion / SQL Injection

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-107933. PoCs published by Dawid Golunski.

AI-analyzed exploit summary This is a detailed writeup explaining Local PHP File Inclusion and SQL Injection vulnerabilities in Invision Power Board versions <= 3.0.4 and <= 2.3.6. It describes the input sanitization process and how it can be bypassed.

Description

Invision Power Board 2.3.6/3.0.4 - Local File Inclusion / SQL Injection

Exploits (1)

exploitdb WRITEUP
by Dawid Golunski · textwebappsphp
https://www.exploit-db.com/exploits/10304

This is a detailed writeup explaining Local PHP File Inclusion and SQL Injection vulnerabilities in Invision Power Board versions <= 3.0.4 and <= 2.3.6. It describes the input sanitization process and how it can be bypassed.

Classification
Writeup 90%
Attack Type
Sqli | Info Leak
Complexity
Moderate
Reliability
Theoretical
Target: Invision Power Board <= 3.0.4 and <= 2.3.6
No auth needed
Prerequisites: Access to the target application · Knowledge of the application's file structure
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026