Advisories · Technology
SPIP.
Every CVE that names SPIP among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
SPIP before 4.4.29 Authenticated SQL Injection via where Parameter
- SPIP
- SQL injection
- CVSS 5.3 Medium
SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url
- SPIP
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection
- SPIP
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
SPIP < 4.4.18 Missing Authorization via ecrire/action/
- SPIP
- Broken access control
- CVSS 8.7 High
SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html
- SPIP
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Code injection in SPIP
- SPIP
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Code injection in SPIP
- SPIP
- Code injection
- CVSS 7.7 High
SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite
- SPIP
- Code injection
- CVSS 3.5 Low
Open redirect in SPIP
- SPIP
- Open redirect
- CVSS 9.2 CriticalCritical · CVSS 9+
SPIP < 4.4.14 Remote Code Execution via nginx
- SPIP
- Code injection
- CVSS 8.7 High
SPIP < 4.4.14 Remote Code Execution via Private Space
- SPIP
- Code injection
- CVSS 6.7 Medium
SPIP: SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of…
- SPIP
- CWE-688
- CVSS 8.7 High
SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling
- SPIP
- Authentication bypass
- CVSS 8.7 High
SPIP < 4.4.10 SQL Injection RCE via Union & PHP Tags
- SPIP
- SQL injection
- CVSS 9.2 CriticalCritical · CVSS 9+
SPIP < 4.4.9 Insecure Deserialization
- SPIP
- CVSS 4.8 Medium
SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)
- SPIP
- CVSS 5.1 Medium
SPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated Sites
- SPIP
- CVSS 5.3 Medium
SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites
- SPIP
- CVSS 5.1 Medium
SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area
- SPIP
- CVSS 8.6 High
SPIP < 4.4.8 Cross-Site Scripting in Public Area
- SPIP
- CVSS 5.1 Medium
SPIP < 4.4.5 Open Redirect via Login Form
- SPIP
- Open redirect
- CVSS 5.3 Medium
SPIP < 4.3.6 Authorization Bypass Leading to Content Disclosure
- SPIP
- Broken access control
- CVSS 4.8 Medium
SPIP < 4.3.6 Cross-Site Scripting in Private Area
- SPIP
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
SPIP < 4.2.15 Cross-Site Scripting via Code Tags
- SPIP
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Spip 4.1.10 Admin Account Spoofing via Malicious SVG Upload
- spip
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
SPIP Bigup Multipart File Upload OS Command Injection
- SPIP
- Path traversal
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
SPIP porte_plume Plugin Arbitrary PHP Execution
- SPIP
- Code injection
- CWE-1286