CVE-2017-8897: Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UT...

Security readout for executives and security teams

CVE-2017-8897 is a pre-authentication reflected cross-site scripting issue in IPS Community Suite 4.1.19.2 and earlier through the IPS UTF8 Converter. A reachable vulnerable converter could let an attacker inject browser-executed content, reportedly including malicious announcements shown to Invision Power Board users. Exposure is most likely on older IPS Community Suite or Invision Power Board deployments that still have the vulnerable UTF8 Converter reachable. Risk is higher if administrative conversion paths are internet-accessible and users can be induced to view attacker-influenced announcements. Prioritize if the organization still runs legacy IPS Community Suite or Invision Power Board. The issue is old, but public and pre-authenticated; unsupported community platforms can create reputational risk if attackers inject content viewed by customers or forum users. Mitigation focus: Inventory IPS Community Suite and Invision Power Board deployments.; Check IPS vendor guidance for upgrade, removal, or mitigation instructions.; Restrict access to administrative conversion utilities until remediated..

Prepared

Jun 13, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.