CVE-2026-66738 | High | 8.8 | 2026-08-10 | SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user inp… |
CVE-2026-48832 | Low | 3.5 | 2026-05-24 | action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability. |
CVE-2026-8430 | High | 8.1 | 2026-05-12 | SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attac… |
CVE-2026-8429 | High | 8.8 | 2026-05-12 | SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context… |
CVE-2026-33549 | Medium | 6.7 | 2026-03-22 | SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an author data structure be… |
CVE-2026-22206 | High | 8.8 | 2026-02-26 | SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulat… |
CVE-2026-22205 | High | 7.5 | 2026-02-26 | SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protec… |
CVE-2026-27747 | High | 8.8 | 2026-02-25 | The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated SQL injection vulnerability in interface_traduction_objets_pipelin… |
CVE-2026-27746 | Medium | 6.1 | 2026-02-25 | The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the pre_propre pipeline. The plugin incorporates u… |
CVE-2026-27745 | High | 8.8 | 2026-02-25 | The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated remote code execution vulnerability in the translation interface w… |
CVE-2026-27744 | Critical | 9.8 | 2026-02-25 | The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket… |
CVE-2026-27743 | Critical | 9.8 | 2026-02-25 | The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_suppri… |
CVE-2026-27475 | High | 8.1 | 2026-02-19 | SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An at… |
CVE-2026-27474 | Medium | 6.1 | 2026-02-19 | SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8. The echappe_anti_xss() function was n… |
CVE-2026-27473 | Medium | 6.4 | 2026-02-19 | SPIP before 4.4.9 allows Stored Cross-Site Scripting (XSS) via syndicated sites in the private area. The #URL_SYNDIC output is not properly sanitized on the pr… |
CVE-2026-27472 | Medium | 4.3 | 2026-02-19 | SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area. When editing a syndicated site, the application doe… |
CVE-2026-26345 | Medium | 5.4 | 2026-02-19 | SPIP before 4.4.8 contains a stored cross-site scripting (XSS) vulnerability in the public area triggered in certain edge-case usage patterns. The echapper_htm… |
CVE-2026-26223 | Medium | 6.1 | 2026-02-19 | SPIP before 4.4.8 allows cross-site scripting (XSS) in the private area via malicious iframe tags. The application does not properly sandbox or escape iframe c… |
CVE-2025-71244 | Medium | 6.1 | 2026-02-19 | SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a vi… |
CVE-2025-71243 | Critical | 9.8 | 2026-02-19 | The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacke… |
CVE-2025-71242 | Medium | 6.5 | 2026-02-19 | SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check authorization when di… |
CVE-2025-71241 | Medium | 6.1 | 2026-02-19 | SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by the 'transmettre' AP… |
CVE-2025-71240 | Medium | 5.4 | 2026-02-19 | SPIP before 4.2.15 allows Cross-Site Scripting (XSS) via crafted content in HTML code tags. The application does not properly verify JavaScript within code tag… |
CVE-2023-53900 | High | 8.8 | 2025-12-16 | Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Attackers can trick administ… |
CVE-2024-53620 | Medium | 4.8 | 2024-11-26 | A cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scripts or HTML via inj… |
CVE-2024-53619 | Medium | 6.3 | 2024-11-26 | An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2024-8517 | Critical | 9.8 | 2024-09-06 | SPIP before 4.3.2, 4.2.16, and
4.1.18 is vulnerable to a command injection issue. A
remote and unauthenticated attacker can execute arbitrary operating syste… |
CVE-2024-7954 | Critical | 9.8 | 2024-08-23 | The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthentic… |
CVE-2024-23659 | Medium | 6.1 | 2024-01-19 | SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js. |
CVE-2023-52322 | Medium | 6.1 | 2024-01-04 | ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as… |
CVE-2023-27372 | Critical | 9.8 | 2023-02-28 | SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4… |
CVE-2023-24258 | Critical | 9.8 | 2023-02-27 | SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter. This vulnerability allows attackers to execute arbitra… |
CVE-2022-37155 | High | 8.8 | 2022-12-14 | RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter. |
CVE-2022-28961 | High | 8.8 | 2022-05-19 | Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters. |
CVE-2022-28960 | High | 8.8 | 2022-05-19 | A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire. |
CVE-2022-28959 | Medium | 6.1 | 2022-05-19 | Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary we… |
CVE-2022-26847 | Medium | 5.3 | 2022-03-10 | SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects. |
CVE-2022-26846 | High | 8.8 | 2022-03-10 | SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code. |
CVE-2021-44123 | High | 8.8 | 2022-01-26 | SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double exte… |
CVE-2021-44122 | High | 8.8 | 2022-01-26 | SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire… |
CVE-2021-44120 | Medium | 5.4 | 2022-01-26 | SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An… |
CVE-2021-44118 | Medium | 5.4 | 2022-01-26 | SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerab… |
CVE-2020-28984 | Critical | 9.8 | 2020-11-23 | prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage… |
CVE-2019-19830 | Medium | 6.5 | 2019-12-17 | _core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database. |
CVE-2019-16394 | Medium | 5.3 | 2019-09-17 | SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which… |
CVE-2019-16393 | Medium | 6.1 | 2019-09-17 | SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character. |
CVE-2019-16392 | Medium | 6.1 | 2019-09-17 | SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages. |
CVE-2019-16391 | Medium | 6.5 | 2019-09-17 | SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is… |
CVE-2019-11071 | High | 8.8 | 2019-04-10 | SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled. |
CVE-2017-15736 | Medium | 6.1 | 2017-10-22 | Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as… |
CVE-2017-9736 | Critical | 9.8 | 2017-06-17 | SPIP 3.1.x before 3.1.6 and 3.2.x before Beta 3 does not remove shell metacharacters from the host field, allowing a remote attacker to cause remote code execu… |
CVE-2016-7999 | High | 7.4 | 2017-01-18 | ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url pa… |
CVE-2016-7998 | High | 8.8 | 2017-01-18 | The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a… |
CVE-2016-7982 | High | 7.5 | 2017-01-18 | Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the… |
CVE-2016-7981 | Medium | 6.1 | 2017-01-18 | Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the va… |
CVE-2016-7980 | High | 8.8 | 2017-01-18 | Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication o… |
CVE-2016-9998 | Medium | 6.1 | 2016-12-17 | SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/info_plugin.php involving the `$plugin` parameter, as demonstrated by a /… |
CVE-2016-9997 | Medium | 6.1 | 2016-12-17 | SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/puce_statut.php involving the `$id` parameter, as demonstrated by a /ecr… |
CVE-2016-9152 | Medium | 6.1 | 2016-12-05 | Cross-site scripting (XSS) vulnerability in ecrire/exec/plonger.php in SPIP 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the rac pa… |
CVE-2016-3154 | Critical | 9.8 | 2016-04-08 | The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to… |
CVE-2016-3153 | Critical | 9.8 | 2016-04-08 | SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the fil… |
CVE-2013-7303 | | | 2014-01-30 | Multiple cross-site scripting (XSS) vulnerabilities in (1) squelettes-dist/formulaires/inscription.php and (2) prive/forms/editer_auteur.php in SPIP before 2.1… |
CVE-2013-4557 | | | 2013-11-18 | The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitra… |
CVE-2013-4556 | | | 2013-11-18 | Cross-site scripting (XSS) vulnerability in the author page (prive/formulaires/editer_auteur.php) in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote a… |
CVE-2013-4555 | | | 2013-11-18 | Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbit… |
CVE-2013-2118 | | | 2013-07-09 | SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "take editorial control" via vectors relat… |
CVE-2012-4331 | | | 2012-08-14 | Multiple unspecified vulnerabilities in SPIP before 1.9.2.o, 2.0.x before 2.0.18, and 2.1.x before 2.1.13 have unknown impact and attack vectors that are not r… |
CVE-2012-2151 | | | 2012-08-14 | Multiple cross-site scripting (XSS) vulnerabilities in SPIP 1.9.x before 1.9.2.o, 2.0.x before 2.0.18, and 2.1.x before 2.1.13 allow remote attackers to inject… |
CVE-2009-3041 | | | 2009-09-01 | SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire/exec/install.php and (2) ecrire/index.php, which allows remote… |
CVE-2008-5813 | | | 2009-01-02 | SQL injection vulnerability in inc/rubriques.php in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 allows remote attackers to execute arbitrar… |
CVE-2008-5812 | | | 2009-01-02 | Multiple unspecified vulnerabilities in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 have unknown impact and attack vectors. |
CVE-2007-4525 | | | 2007-08-25 | PHP remote file inclusion vulnerability in inc-calcul.php3 in SPIP 1.7.2 allows remote attackers to execute arbitrary PHP code via a URL in the squelette_cache… |
CVE-2006-1702 | | | 2006-04-11 | PHP remote file inclusion vulnerability in spip_login.php3 in SPIP 1.8.3 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter. |
CVE-2006-1295 | | | 2006-03-19 | Cross-site scripting (XSS) vulnerability in recherche.php3 in SPIP 1.8.2-g allows remote attackers to inject arbitrary web script or HTML via the recherche par… |
CVE-2006-0626 | | | 2006-02-09 | SQL injection vulnerability in spip_acces_doc.php3 in SPIP 1.8.2g and earlier allows remote attackers to execute arbitrary SQL commands via the file parameter. |
CVE-2006-0625 | | | 2006-02-09 | Directory traversal vulnerability in Spip_RSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via ".." sequences in… |
CVE-2006-0519 | | | 2006-02-02 | SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3… |
CVE-2006-0518 | | | 2006-02-02 | Cross-site scripting (XSS) vulnerability in index.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to inject arbitra… |
CVE-2006-0517 | | | 2006-02-02 | Multiple SQL injection vulnerabilities in formulaires/inc-formulaire_forum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allow remote att… |
CVE-2005-4494 | | | 2005-12-22 | Cross-site scripting (XSS) vulnerability in SPIP 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to… |