Invision Power Board version 1.3.1 Final is susceptible to cross site scripting and SQL injection attacks.