SPIP vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20251
3. 202631

Newest CVEs

• CVE-2026-122032

  SPIP before 4.4.29 Authenticated SQL Injection via where Parameter

  SPIP · SPIP

  High7.1
• CVE-2026-109378

  SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url

  SPIP · SPIP

  Medium5.3
• CVE-2026-104070

  SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE

  SPIP · SPIP Crayons Plugin

  Critical9.3
• CVE-2026-72710

  SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection

  SPIP · SPIP

  Critical9.3
• CVE-2026-72709

  SPIP < 4.4.18 Missing Authorization via ecrire/action/

  SPIP · SPIP

  Critical9.3
• CVE-2026-72708

  SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html

  SPIP · SPIP

  High8.7
• CVE-2026-77806

  SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code…

  SPIP · SPIP

  Critical9.8
• CVE-2026-77647

  SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect…

  SPIP · SPIP

  Critical9.8
• CVE-2026-66738

  SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite

  SPIP · SPIP

  High7.7
• CVE-2026-48832

  action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability.

  SPIP · SPIP

  Low3.5