SP
Product
spip
80
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 12High 19Medium 29Low 1
Watch
Add spip to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-9152 | 6.1 | Dec 5 | Cross-site scripting (XSS) vulnerability in ecrire/exec/plonger.php in SPIP 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the rac parameter Affected: 3.1.3 |
| CVE-2026-26345 | 5.4 | Feb 19 | SPIP < 4.4.8 Cross-Site Scripting in Public Area Affected: 4.4.0 before 4.4.8 |
| CVE-2025-71240 | 5.4 | Feb 19 | SPIP < 4.2.15 Cross-Site Scripting via Code Tags Affected: 4.2.0 before 4.2.15 |
| CVE-2021-44120 | 5.4 | Jan 26 | SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields Affected: 4.0.0 |
| CVE-2021-44118 | 5.4 | Jan 26 | SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability Affected: 4.0.0 |
| CVE-2022-26847 | 5.3 | Mar 10 | SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects Affected: before 3.2.14; 4.0.0 before 4.0.5 |
| CVE-2019-16394 | 5.3 | Sep 17 | SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers… Affected: before 3.1.11; 3.2.0 before 3.2.5 |
| CVE-2024-53620 | 4.8 | Nov 26 | A cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted… Affected: 4.3.3 |
| CVE-2026-109378 | 4.3 | Oct 12 | SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url Affected: before 4.4.18 |
| CVE-2026-27472 | 4.3 | Feb 19 | SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites Affected: 4.4.0 before 4.4.9 |
| CVE-2026-48832 | 3.5 | May 24 | action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability Affected: before 4.4.15 |
| CVE-2013-7303 | – | Jan 30 | Multiple cross-site scripting (XSS) vulnerabilities in (1) squelettes-dist/formulaires/inscription.php and (2) prive/forms/editer_auteur.php in SPIP before 2.1.25 and 3.0.x before… Affected: through 2.1.24; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2013-4557 | – | Nov 18 | The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +6 more |
| CVE-2013-4556 | – | Nov 18 | Cross-site scripting (XSS) vulnerability in the author page (prive/formulaires/editer_auteur.php) in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote attackers to inject… Affected: through 2.1.23; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2013-4555 | – | Nov 18 | Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for… Affected: through 2.1.23; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2013-2118 | – | Jul 9 | SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "take editorial control" via vectors related to… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +34 more |
| CVE-2012-4331 | – | Aug 14 | Multiple unspecified vulnerabilities in SPIP before 1.9.2.o, 2.0.x before 2.0.18, and 2.1.x before 2.1.13 have unknown impact and attack vectors that are not related to cross-site… Affected: 1.9; 1.9.1; 1.9.2; 2.0; 2.1 |
| CVE-2012-2151 | – | Aug 14 | Multiple cross-site scripting (XSS) vulnerabilities in SPIP 1.9.x before 1.9.2.o, 2.0.x before 2.0.18, and 2.1.x before 2.1.13 allow remote attackers to inject arbitrary web… Affected: 1.9; 1.9.1; 1.9.2; 2.0; 2.1 |
| CVE-2009-3041 | – | Sep 1 | SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire/exec/install.php and (2) ecrire/index.php, which allows remote attackers to… Affected: 1.9; 1.9; 1.9.1; 1.9.2c; 1.9.2d; 1.9.2g; +12 more |
| CVE-2008-5813 | – | Jan 2 | SQL injection vulnerability in inc/rubriques.php in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 allows remote attackers to execute arbitrary SQL commands via… Affected: 1.8; 1.8.1; 1.8.2; 1.8.2b; 1.8.3; 1.8b1; +12 more |
| CVE-2008-5812 | – | Jan 2 | Multiple unspecified vulnerabilities in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 have unknown impact and attack vectors Affected: 1.8; 1.8.1; 1.8.2; 1.8.2b; 1.8.3; 1.8b1; +12 more |
| CVE-2007-4525 | – | Aug 25 | PHP remote file inclusion vulnerability in inc-calcul.php3 in SPIP 1.7.2 allows remote attackers to execute arbitrary PHP code via a URL in the squelette_cache parameter, a… Affected: 1.7.2 |
| CVE-2006-1702 | – | Apr 11 | PHP remote file inclusion vulnerability in spip_login.php3 in SPIP 1.8.3 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter Affected: 1.8.3 |
| CVE-2006-1295 | – | Mar 19 | Cross-site scripting (XSS) vulnerability in recherche.php3 in SPIP 1.8.2-g allows remote attackers to inject arbitrary web script or HTML via the recherche parameter Affected: 1.8.2e; 1.8.2g |
| CVE-2006-0626 | – | Feb 9 | SQL injection vulnerability in spip_acces_doc.php3 in SPIP 1.8.2g and earlier allows remote attackers to execute arbitrary SQL commands via the file parameter Affected: 1.8.2g |
| CVE-2006-0625 | – | Feb 9 | Directory traversal vulnerability in Spip_RSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via ".." sequences in the… Affected: 1.8.2d; 1.8.2e; 1.8.2g |
| CVE-2006-0519 | – | Feb 2 | SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3, which reveals the… Affected: through 1.8.2e; through 1.9_alpha2_5539 |
| CVE-2006-0518 | – | Feb 2 | Cross-site scripting (XSS) vulnerability in index.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to inject arbitrary web script or… Affected: through 1.8.2e; through 1.9_alpha2_5539 |
| CVE-2006-0517 | – | Feb 2 | Multiple SQL injection vulnerabilities in formulaires/inc-formulaire_forum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allow remote attackers to execute… Affected: through 1.8.2e; through 1.9_alpha2_5539 |
| CVE-2005-4494 | – | Dec 22 | Cross-site scripting (XSS) vulnerability in SPIP 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) spip_login.php3… Affected: 1.8.2 |