SP
Product
spip
80
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 12High 19Medium 29Low 1
Watch
Add spip to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-71242 | 6.5 | Feb 19 | SPIP < 4.3.6 Authorization Bypass Leading to Content Disclosure Affected: 4.1.0 before 4.1.20; 4.2.0 before 4.2.17; 4.3.0 before 4.3.6 |
| CVE-2019-19830 | 6.5 | Dec 17 | _core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database Affected: 3.2.0 before 3.2.7 |
| CVE-2019-16391 | 6.5 | Sep 17 | SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database Affected: before 3.1.11; 3.2.0 before 3.2.5 |
| CVE-2026-27473 | 6.4 | Feb 19 | SPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated Sites Affected: 4.4.0 before 4.4.9 |
| CVE-2024-53619 | 6.3 | Nov 26 | An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file Affected: 4.3.3 |
| CVE-2026-27474 | 6.1 | Feb 19 | SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix) Affected: 4.4.0 before 4.4.9 |
| CVE-2026-26223 | 6.1 | Feb 19 | SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area Affected: 4.4.0 before 4.4.8 |
| CVE-2025-71244 | 6.1 | Feb 19 | SPIP < 4.4.5 Open Redirect via Login Form Affected: 4.3.0 before 4.3.9; 4.4.0 before 4.4.5 |
| CVE-2025-71241 | 6.1 | Feb 19 | SPIP < 4.3.6 Cross-Site Scripting in Private Area Affected: 4.1.0 before 4.1.20; 4.2.0 before 4.2.17; 4.3.0 before 4.3.6 |
| CVE-2023-53900 | 6.1 | Dec 16 | Spip 4.1.10 Admin Account Spoofing via Malicious SVG Upload Affected: 4.1.10 |
| CVE-2024-23659 | 6.1 | Jan 19 | SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file Affected: before 4.1.14; 4.2.0 before 4.2.8 |
| CVE-2023-52322 | 6.1 | Jan 4 | ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics Affected: before 4.1.13; 4.2.0 before 4.2.7 |
| CVE-2022-28959 | 6.1 | May 19 | Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary web scripts or HTML Affected: through 3.1.13 |
| CVE-2019-16393 | 6.1 | Sep 17 | SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character Affected: before 3.1.11; 3.2.0 before 3.2.5 |
| CVE-2019-16392 | 6.1 | Sep 17 | SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages Affected: before 3.1.11; 3.2.0 before 3.2.5 |
| CVE-2017-15736 | 6.1 | Oct 22 | Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as demonstrated by a… Affected: through 3.1.6 |
| CVE-2016-7981 | 6.1 | Jan 18 | Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a… Affected: through 3.1.2 |
| CVE-2016-9998 | 6.1 | Dec 17 | SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/info_plugin.php involving the `$plugin` parameter, as demonstrated by a… Affected: 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0; +3 more |
| CVE-2016-9997 | 6.1 | Dec 17 | SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/puce_statut.php involving the `$id` parameter, as demonstrated by a… Affected: 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.0; +3 more |
| CVE-2016-9152 | 6.1 | Dec 5 | Cross-site scripting (XSS) vulnerability in ecrire/exec/plonger.php in SPIP 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the rac parameter Affected: 3.1.3 |
| CVE-2026-26345 | 5.4 | Feb 19 | SPIP < 4.4.8 Cross-Site Scripting in Public Area Affected: 4.4.0 before 4.4.8 |
| CVE-2025-71240 | 5.4 | Feb 19 | SPIP < 4.2.15 Cross-Site Scripting via Code Tags Affected: 4.2.0 before 4.2.15 |
| CVE-2021-44120 | 5.4 | Jan 26 | SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields Affected: 4.0.0 |
| CVE-2021-44118 | 5.4 | Jan 26 | SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability Affected: 4.0.0 |
| CVE-2022-26847 | 5.3 | Mar 10 | SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects Affected: before 3.2.14; 4.0.0 before 4.0.5 |
| CVE-2019-16394 | 5.3 | Sep 17 | SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers… Affected: before 3.1.11; 3.2.0 before 3.2.5 |
| CVE-2024-53620 | 4.8 | Nov 26 | A cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted… Affected: 4.3.3 |
| CVE-2026-109378 | 4.3 | Oct 12 | SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url Affected: before 4.4.18 |
| CVE-2026-27472 | 4.3 | Feb 19 | SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites Affected: 4.4.0 before 4.4.9 |
Showing 29