SP
Product
spip
79
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 11High 19Medium 29Low 1
Watch
Add spip to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-66738 | 8.8 | Aug 10 | SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite Affected: before 4.4.18 |
| CVE-2026-8429 | 8.8 | May 12 | SPIP < 4.4.14 Remote Code Execution via Private Space Affected: before 4.4.14 |
| CVE-2026-33549 | 8.8 | Mar 22 | SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an author data structure because of STATUT… Affected: 4.4.10 before 4.4.13 |
| CVE-2026-22206 | 8.8 | Feb 26 | SPIP < 4.4.10 SQL Injection RCE via Union & PHP Tags Affected: before 4.4.10 |
| CVE-2022-37155 | 8.8 | Dec 14 | RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter Affected: 3.1.13 through 4.1.2 |
| CVE-2022-28961 | 8.8 | May 19 | Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters Affected: through 3.1.13 |
| CVE-2022-28960 | 8.8 | May 19 | A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire Affected: before 3.2.8 |
| CVE-2022-26846 | 8.8 | Mar 10 | SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code Affected: before 3.2.14; 4.0.0 before 4.0.5 |
| CVE-2021-44123 | 8.8 | Jan 26 | SPIP 4.0.0 is affected by a remote command execution vulnerability Affected: 4.0.0 |
| CVE-2021-44122 | 8.8 | Jan 26 | SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php Affected: 4.0.0 |
| CVE-2019-11071 | 8.8 | Apr 10 | SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled Affected: 3.1.0 before 3.1.10; 3.2.0 before 3.2.4 |
| CVE-2016-7998 | 8.8 | Jan 18 | The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted (1) INCLUDE… Affected: through 3.1.2 |
| CVE-2016-7980 | 8.8 | Jan 18 | Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for… Affected: through 3.1.2 |
| CVE-2026-8430 | 8.1 | May 12 | SPIP < 4.4.14 Remote Code Execution via nginx Affected: before 4.4.14 |
| CVE-2026-27475 | 8.1 | Feb 19 | SPIP < 4.4.9 Insecure Deserialization Affected: 4.4.0 before 4.4.9 |
| CVE-2026-72708 | 7.5 | Sep 11 | SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html Affected: before 4.4.18 |
| CVE-2026-22205 | 7.5 | Feb 26 | SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling Affected: before 4.4.10 |
| CVE-2016-7982 | 7.5 | Jan 18 | Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the var_url parameter… Affected: through 3.1.2 |
| CVE-2016-7999 | 7.4 | Jan 18 | ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url parameter in a… Affected: through 3.1.2 |
Showing 19