CVE-2016-3153
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to...
CVE-2016-3153 is a critical vulnerability (CVSS 9.8) in Spip, published March 16, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in spip 3.0.22-1.
- Severity
- 9.8 CriticalCVSS 3.0, NVD
- Exploit chance
- 1.84%EPSS, 79th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.0.22-1spip +4 more
Description
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
spipDebian:13 | before 3.0.22-1 | 3.0.22-1 |
spipDebian:14 | before 3.0.22-1 | 3.0.22-1 |
spipDebian:7 From an advisory covering 2 CVEs | before 2.1.17-1+deb7u5, plus listed versions 2.1.17-12.1.17-1+deb7u12.1.17-1+deb7u22.1.17-1+deb7u32.1.17-1+deb7u4 | 2.1.17-1+deb7u5 |
spipDebian:8 From an advisory covering 2 CVEs | before 3.0.17-2+deb8u2, plus listed versions 3.0.17-23.0.17-2+deb8u1 | 3.0.17-2+deb8u2 |
spipUbuntu:Pro:16.04:LTS | All versions, plus listed versions 3.0.20-13.0.21-13.0.21-1ubuntu13.0.21-1ubuntu1+esm1 | None known |
What each source reports
NVD Score used
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
- Record
CVE-2016-3153- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE ListNo score
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
- Record
CVE-2016-3153- Updated
- 2026-11-02
EUVDEUVD-2016-4205No score
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
- Record
EUVD-2016-4205- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-59w9-3w7r-f858
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to...
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
- Record
GHSA-59w9-3w7r-f858- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
- Record
CVE-2016-3153- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-3153
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
- Record
DEBIAN-CVE-2016-3153- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-3153
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
- Record
UBUNTU-CVE-2016-3153- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
core.spip.net/projects/spip/repository/revisions/22911
blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-1-SPIP-3-0-22-et-SPIP-2-1.html?lang=fr
debian.org/security/2016/dsa-3518
nvd.nist.gov/vuln/detail/CVE-2016-3153
github.com/advisories/GHSA-59w9-3w7r-f858
security-tracker.debian.org/tracker/CVE-2016-3153
ubuntu.com/security/CVE-2016-3153
openwall.com/lists/oss-security/2016/03/15/2
cve.org/CVERecord?id=CVE-2016-3153