Vulnerability · Published Feb 19, 2026 · Assigned by VulnCheck

CVE-2025-71243SPIP Saisies Plugin < 5.11.1 Remote Code Execution

Critical 9.8

In plain English

A critical-severity code injection in Saisies pour formulaire from SPIP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.6% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)5.6%top 7.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling3Metasploit, Nuclei, Public PoC

Official description

The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately update to version 5.11.1 or later.

Affected products (as reported)

Vendor	Product	Versions
SPIP	Saisies pour formulaire	5.4.0 – before 5.11.1

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://blog.spip.net/Mise-a-jour-critique-de-securite-pour-le-plugin-Saisies.html vendor-advisory, patch
https://plugins.spip.net/saisies product
VulnCheck Advisory: SPIP Saisies Plugin < 5.11.1 Remote Code Execution third-party-advisory