Login Request a demo
SP
Product
spip
by spip · last CVE Oct 12, 2026
80
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities80In the news0Timeline
Severity mix
Critical 12High 19Medium 29Low 1
Severity
All severities80Critical12High19Medium29Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add spip to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-72710
9.8
1%
Sep 11
SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection
Affected: before 4.4.18
CVE-2026-72709
9.8
1%
Sep 11
SPIP < 4.4.18 Missing Authorization via ecrire/action/
Affected: before 4.4.18
CVE-2026-77806
9.8
4%
Aug 21
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026
Affected: before 4.4.21
CVE-2026-77647
9.8
2%
Aug 20
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026
Affected: before 4.4.20
CVE-2024-8517
9.8
95%
Sep 6
SPIP Bigup Multipart File Upload OS Command Injection
Affected: 4.3.0 through 4.3.1; 4.2.0 through 4.2.15; 4.1.0 through 4.1.18
CVE-2024-7954
9.8
90%
Aug 23
SPIP porte_plume Plugin Arbitrary PHP Execution
Affected: 4.3.0-alpha before 4.3.0-alpha2; 4.2.0 before 4.2.13; 4.1.0 before 4.1.16
CVE-2023-27372
9.8
100%
Feb 28
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled
Affected: before 3.2.18; 4.0.0 before 4.0.10; 4.1.0 before 4.1.8; 4.2.0; 4.2.0; 4.2.0
CVE-2023-24258
9.8
2%
Feb 27
SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter
Affected: through 4.1.5
CVE-2020-28984
9.8
2%
Nov 23
prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran…
Affected: before 3.2.8
CVE-2017-9736
9.8
3%
Jun 17
SPIP 3.1.x before 3.1.6 and 3.2.x before Beta 3 does not remove shell metacharacters from the host field, allowing a remote attacker to cause remote code execution
Affected: 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0; +8 more
CVE-2016-3154
9.8
2%
Apr 8
The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object…
Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more
CVE-2016-3153
9.8
2%
Apr 8
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites…
Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more
Showing 12