spip spip vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20251
3. 202624

Newest CVEs

• CVE-2026-122032

  SPIP before 4.4.29 Authenticated SQL Injection via where Parameter

  SPIP · SPIP

  High7.1
• CVE-2026-109378

  SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url

  SPIP · SPIP

  Medium5.3
• CVE-2026-72710

  SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection

  SPIP · SPIP

  Critical9.3
• CVE-2026-72709

  SPIP < 4.4.18 Missing Authorization via ecrire/action/

  SPIP · SPIP

  Critical9.3
• CVE-2026-72708

  SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html

  SPIP · SPIP

  High8.7
• CVE-2026-77806

  SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code…

  SPIP · SPIP

  Critical9.8
• CVE-2026-77647

  SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect…

  SPIP · SPIP

  Critical9.8
• CVE-2026-66738

  SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite

  SPIP · SPIP

  High7.7
• CVE-2026-48832

  action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability.

  SPIP · SPIP

  Low3.5
• CVE-2026-8430

  SPIP < 4.4.14 Remote Code Execution via nginx

  SPIP · SPIP

  Critical9.2