SSPIP

Products

Exploited and recent CVEs

• CVE-2026-122032 Medium 6.5 SPIP before 4.4.29 Authenticated SQL Injection via where Parameter 0.3%
• CVE-2026-109378 Medium 4.3 SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url 0.2%
• CVE-2026-104070 Critical 9.8 SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE 0.6%
• CVE-2026-72710 Critical 9.8 SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection 1.1%
• CVE-2026-72709 Critical 9.8 SPIP < 4.4.18 Missing Authorization via ecrire/action/ 0.7%
• CVE-2026-72708 High 7.5 SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html 0.5%
• CVE-2026-77806 Critical 9.8 SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request heade 4.5%
• CVE-2026-77647 Critical 9.8 SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_expo 2.3%
• CVE-2026-66738 High 8.8 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite 0.6%
• CVE-2026-48832 Low 3.5 action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability. 0.2%
• CVE-2026-8430 High 8.1 SPIP < 4.4.14 Remote Code Execution via nginx 0.4%
• CVE-2026-8429 High 8.8 SPIP < 4.4.14 Remote Code Execution via Private Space 0.5%
• CVE-2026-33549 Medium 6.7 SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an author data structure because of STATUT mishandling. 0.2%
• CVE-2026-22205 High 7.5 SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling 0.5%
• CVE-2026-22206 High 8.8 SPIP < 4.4.10 SQL Injection RCE via Union & PHP Tags 0.6%
• CVE-2026-27743 Critical 9.8 SPIP referer_spam < 1.3.0 Unauthenticated SQL Injection 0.7%
• CVE-2026-27744 Critical 9.8 SPIP tickets < 4.3.3 Unauthenticated RCE 1.0%
• CVE-2026-27745 High 8.8 SPIP interface_traduction_objets < 2.2.2 Authenticated RCE 0.9%
• CVE-2026-27746 Medium 6.1 SPIP jeux < 4.1.1 Reflected XSS via index Parameters 0.2%
• CVE-2026-27747 High 8.8 SPIP interface_traduction_objets < 2.2.2 Authenticated SQL Injection 0.4%
• CVE-2026-27475 High 8.1 SPIP < 4.4.9 Insecure Deserialization 0.9%
• CVE-2026-27474 Medium 6.1 SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix) 0.3%
• CVE-2026-27473 Medium 6.4 SPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated Sites 0.3%
• CVE-2026-27472 Medium 4.3 SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites 0.3%
• CVE-2026-26223 Medium 6.1 SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area 0.2%
• CVE-2026-26345 Medium 5.4 SPIP < 4.4.8 Cross-Site Scripting in Public Area 0.2%
• CVE-2025-71244 Medium 6.1 SPIP < 4.4.5 Open Redirect via Login Form 0.2%
• CVE-2025-71243 Critical 9.8 SPIP Saisies Plugin < 5.11.1 Remote Code Execution 5.6%
• CVE-2025-71242 Medium 6.5 SPIP < 4.3.6 Authorization Bypass Leading to Content Disclosure 0.4%
• CVE-2025-71241 Medium 6.1 SPIP < 4.3.6 Cross-Site Scripting in Private Area 0.3%