Login Request a demo
SP
Vendor
spip
8 products with CVEs on record
87
CVEs
0
On KEV
2
New 30D
Products
SP
spip
spip
9.8
79 CVEs0 on KEV1 new
SC
SPIP Crayons Plugin
SPIP
9.8
1 CVEs0 on KEV1 new
IN
interface_traduction_objets
SPIP
8.8
2 CVEs0 on KEV0 new
JE
jeux
SPIP
6.1
1 CVEs0 on KEV0 new
RE
referer_spam
SPIP
9.8
1 CVEs0 on KEV0 new
SA
Saisies
Spip
9.8
1 CVEs0 on KEV0 new
SP
Saisies pour formulaire
SPIP
9.8
1 CVEs0 on KEV0 new
TI
tickets
SPIP
9.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-109378
SP
SPIP
SPIP
4.3
0%
Oct 12SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url
CVE-2026-104070
SC
SPIP Crayons Plugin
SPIP
9.8
1%
Oct 6SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE
CVE-2026-72710
SP
SPIP
SPIP
9.8
1%
Sep 11SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection
CVE-2026-72709
SP
SPIP
SPIP
9.8
1%
Sep 11SPIP < 4.4.18 Missing Authorization via ecrire/action/
CVE-2026-72708
SP
SPIP
SPIP
7.5
1%
Sep 11SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html
CVE-2026-77806
SP
SPIP
SPIP
9.8
4%
Aug 21SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026
CVE-2026-77647
SP
SPIP
SPIP
9.8
2%
Aug 20SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026
CVE-2026-66738
SP
SPIP
SPIP
8.8
1%
Aug 10SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite
CVE-2026-48832
SP
SPIP
SPIP
3.5
0%
May 24action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability
CVE-2026-8430
SP
SPIP
SPIP
8.1
0%
May 12SPIP < 4.4.14 Remote Code Execution via nginx
CVE-2026-8429
SP
SPIP
SPIP
8.8
1%
May 12SPIP < 4.4.14 Remote Code Execution via Private Space
CVE-2026-33549
SP
SPIP
SPIP
8.8
0%
Mar 22SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an author data structure because of STATUT…
CVE-2026-22205
SP
SPIP
SPIP
7.5
1%
Feb 26SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling
CVE-2026-22206
SP
SPIP
SPIP
8.8
1%
Feb 26SPIP < 4.4.10 SQL Injection RCE via Union & PHP Tags
CVE-2026-27743
RE
referer_spam
SPIP
9.8
1%
Feb 25SPIP referer_spam < 1.3.0 Unauthenticated SQL Injection
CVE-2026-27744
TI
tickets
SPIP
9.8
1%
Feb 25SPIP tickets < 4.3.3 Unauthenticated RCE
CVE-2026-27745
IN
interface_traduction_objets
SPIP
8.8
1%
Feb 25SPIP interface_traduction_objets < 2.2.2 Authenticated RCE
CVE-2026-27746
JE
jeux
SPIP
6.1
0%
Feb 25SPIP jeux < 4.1.1 Reflected XSS via index Parameters
CVE-2026-27747
IN
interface_traduction_objets
SPIP
8.8
0%
Feb 25SPIP interface_traduction_objets < 2.2.2 Authenticated SQL Injection
CVE-2026-27475
SP
SPIP
SPIP
8.1
1%
Feb 19SPIP < 4.4.9 Insecure Deserialization
CVE-2026-27474
SP
SPIP
SPIP
6.1
0%
Feb 19SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)
CVE-2026-27473
SP
SPIP
SPIP
6.4
0%
Feb 19SPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated Sites
CVE-2026-27472
SP
SPIP
SPIP
4.3
0%
Feb 19SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites
CVE-2026-26223
SP
SPIP
SPIP
6.1
0%
Feb 19SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area
CVE-2026-26345
SP
SPIP
SPIP
5.4
0%
Feb 19SPIP < 4.4.8 Cross-Site Scripting in Public Area
CVE-2025-71244
SP
SPIP
SPIP
6.1
0%
Feb 19SPIP < 4.4.5 Open Redirect via Login Form
CVE-2025-71243
SP
Saisies pour formulaire
SPIP
9.8
6%
Feb 19SPIP Saisies Plugin < 5.11.1 Remote Code Execution
CVE-2025-71242
SP
SPIP
SPIP
6.5
0%
Feb 19SPIP < 4.3.6 Authorization Bypass Leading to Content Disclosure
CVE-2025-71241
SP
SPIP
SPIP
6.1
0%
Feb 19SPIP < 4.3.6 Cross-Site Scripting in Private Area
CVE-2025-71240
SP
SPIP
SPIP
5.4
0%
Feb 19SPIP < 4.2.15 Cross-Site Scripting via Code Tags
CVE-2023-53900
SP
spip
spip
6.1
0%
Dec 16Spip 4.1.10 Admin Account Spoofing via Malicious SVG Upload
CVE-2024-53620
SP
Spip
Spip
4.8
0%
Nov 26A cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted…
CVE-2024-53619
SP
Spip
Spip
6.3
1%
Nov 26An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file
CVE-2024-8517
SP
SPIP
SPIP
9.8
95%
Sep 6SPIP Bigup Multipart File Upload OS Command Injection
CVE-2024-23659
SP
Spip
Spip
6.1
0%
Jan 19SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file
CVE-2023-52322
SP
Spip
Spip
6.1
0%
Jan 4ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics
CVE-2023-27372
SP
Spip
Spip
9.8
100%
Feb 28SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled
CVE-2023-24258
SP
Spip
Spip
9.8
2%
Feb 27SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter
CVE-2022-37155
SP
Spip
Spip
8.8
40%
Dec 14RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter
CVE-2022-28961
SP
Spip
Spip
8.8
2%
May 19Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters
CVE-2022-28960
SP
Spip
Spip
8.8
2%
May 19A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire
CVE-2022-28959
SP
Spip
Spip
6.1
2%
May 19Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary web scripts or HTML
CVE-2022-26847
SP
Spip
Spip
5.3
1%
Mar 10SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects
CVE-2022-26846
SP
Spip
Spip
8.8
3%
Mar 10SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code
CVE-2021-44123
SP
Spip
Spip
8.8
2%
Jan 26SPIP 4.0.0 is affected by a remote command execution vulnerability
CVE-2021-44122
SP
Spip
Spip
8.8
0%
Jan 26SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php
CVE-2021-44120
SP
Spip
Spip
5.4
1%
Jan 26SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields
CVE-2021-44118
SP
Spip
Spip
5.4
1%
Jan 26SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability
CVE-2020-28984
SP
Spip
Spip
9.8
2%
Nov 23prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran…
CVE-2019-19830
SP
Spip
Spip
6.5
1%
Dec 17_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database
CVE-2019-16394
SP
Spip
Spip
5.3
7%
Sep 17SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers…
CVE-2019-16393
SP
Spip
Spip
6.1
1%
Sep 17SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character
CVE-2019-16392
SP
Spip
Spip
6.1
1%
Sep 17SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages
CVE-2019-16391
SP
Spip
Spip
6.5
1%
Sep 17SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database
CVE-2019-11071
SP
Spip
Spip
8.8
3%
Apr 10SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled
CVE-2017-15736
SP
Spip
Spip
6.1
1%
Oct 22Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as demonstrated by a…
CVE-2017-9736
SP
Spip
Spip
9.8
3%
Jun 17SPIP 3.1.x before 3.1.6 and 3.2.x before Beta 3 does not remove shell metacharacters from the host field, allowing a remote attacker to cause remote code execution
CVE-2016-7999
SP
Spip
Spip
7.4
2%
Jan 18ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url parameter in a…
CVE-2016-7998
SP
Spip
Spip
8.8
13%
Jan 18The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted (1) INCLUDE…
CVE-2016-7982
SP
Spip
Spip
7.5
21%
Jan 18Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the var_url parameter…