Skip to contentSpip vulnerabilities
Newest
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via street_view.php thelat and thelng ParametersCVE-2026-350135.1 Medium
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id ParameterCVE-2026-350125.1 Medium
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call ParameterCVE-2026-350115.1 Medium
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id ParameterCVE-2026-350105.1 Medium
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id ParameterCVE-2026-350095.1 Medium
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id ParameterCVE-2026-350085.1 Medium
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id ParameterCVE-2026-350075.1 Medium
- spipSPIP < 4.4.14 Remote Code Execution via nginxCVE-2026-8430Fix available9.2 Critical
- spipSPIP < 4.4.14 Remote Code Execution via Private SpaceCVE-2026-8429Fix available8.7 High
- spipSPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator...CVE-2026-33549Fix available6.7 Medium
- spipSPIP < 4.4.10 Authentication Bypass via PHP Type JugglingCVE-2026-22205Fix available8.7 High
- spipSPIP < 4.4.10 SQL Injection RCE via Union & PHP TagsCVE-2026-22206Fix available8.7 High
- spip referer spamSPIP referer_spam < 1.3.0 Unauthenticated SQL InjectionCVE-2026-277439.3 Critical
- spip ticketsSPIP tickets < 4.3.3 Unauthenticated RCECVE-2026-277449.3 Critical
- spip interface traduction objetsSPIP interface_traduction_objets < 2.2.2 Authenticated RCECVE-2026-277458.7 High
- spip jeuxSPIP jeux < 4.1.1 Reflected XSS via index ParametersCVE-2026-277465.1 Medium
- spip interface traduction objetsSPIP interface_traduction_objets < 2.2.2 Authenticated SQL InjectionCVE-2026-277477.1 High
- spipSPIP < 4.4.9 Insecure DeserializationCVE-2026-27475Public exploitFix available9.2 Critical
- spipSPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)CVE-2026-27474Fix available4.8 Medium
- spipSPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated SitesCVE-2026-27473Fix available5.1 Medium
- spipSPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated SitesCVE-2026-27472Public exploitFix available5.3 Medium
- spipSPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private AreaCVE-2026-26223Fix available5.1 Medium
- spipSPIP < 4.4.8 Cross-Site Scripting in Public AreaCVE-2026-26345Fix available8.6 High
- spipSPIP < 4.4.5 Open Redirect via Login FormCVE-2025-71244Fix available5.1 Medium
- spip saisies, saisies pour formulaire +1 moreSPIP Saisies Plugin < 5.11.1 Remote Code ExecutionCVE-2025-71243Public exploit9.3 Critical
- spipSPIP < 4.3.6 Authorization Bypass Leading to Content DisclosureCVE-2025-71242Fix available5.3 Medium
- spipSPIP < 4.3.6 Cross-Site Scripting in Private AreaCVE-2025-71241Fix available4.8 Medium
- spipSPIP < 4.2.15 Cross-Site Scripting via Code TagsCVE-2025-71240Fix available4.8 Medium
- spipSpip 4.1.10 Admin Account Spoofing via Malicious SVG UploadCVE-2023-539004.8 Medium
- spipA cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows...CVE-2024-536204.8 Medium
- spipAn authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3...CVE-2024-536196.3 Medium
- spipSPIP Bigup Multipart File Upload OS Command InjectionCVE-2024-8517Public exploitFix availableEPSS 94.5%9.8 Critical
- spipSPIP porte_plume Plugin Arbitrary PHP ExecutionCVE-2024-7954Public exploitFix availableEPSS 90.1%9.8 Critical
- spipSPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is...CVE-2024-23659Public exploitFix available6.1 Medium
- spipecrire/public/assembler.php in SPIP before 4.1.3 and 4.2.x before 4.2.7 allows XSS because input...CVE-2023-52322Fix available6.1 Medium
- spip, debian linux +1 moreSPIP before 4.2.1 allows Remote Code Execution via form values in the public area because...CVE-2023-27372Public exploitFix availableEPSS 99.7%9.8 Critical
- spipSPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups...CVE-2023-24258Fix available9.8 Critical
- spipRCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via...CVE-2022-37155Fix availableEPSS 40.0%8.8 High
- spip, debian linux +1 moreSPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about...CVE-2022-26847Fix available5.3 Medium
- spip, debian linux +1 moreSPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary...CVE-2022-26846Fix available8.8 High
- spipSPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability,...CVE-2021-44123Fix available8.8 High
- spipSPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public...CVE-2021-44122Fix available8.8 High
- spipSPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces...CVE-2021-44120Fix available5.4 Medium
- spipSPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. To exploit the...CVE-2021-44118Fix available5.4 Medium
- spipSpip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection...CVE-2022-28961Fix available8.8 High
- spipA PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP...CVE-2022-28960Fix available8.8 High
- spipMultiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web...CVE-2022-28959Fix available6.1 Medium
- spip, debian linux +1 moreImproper Input Validation in SPIPCVE-2020-28984Fix available9.8 Critical
- spip, canonical ubuntu linux, debian linux +2 more_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject...CVE-2019-19830Fix available6.5 Medium
- spip, canonical ubuntu linux, debian linux +2 moreSPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published...CVE-2019-16391Fix available6.5 Medium
- Show moreLoading…