Filtered by vendor Spip Subscriptions
Filtered by product Spip Subscriptions
Total 78 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2006-0625 1 Spip 1 Spip 2026-04-16 N/A
Directory traversal vulnerability in Spip_RSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via ".." sequences in the GLOBALS[type_urls] parameter, which could then be used to execute arbitrary code via resultant direct static code injection in the file parameter to spip_acces_doc.php3.
CVE-2006-0517 1 Spip 1 Spip 2026-04-16 N/A
Multiple SQL injection vulnerabilities in formulaires/inc-formulaire_forum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id_forum, (2) id_article, or (3) id_breve parameters to forum.php3; (4) unspecified vectors related to "session handling"; and (5) when posting "petitions".
CVE-2005-4494 1 Spip 1 Spip 2026-04-16 N/A
Cross-site scripting (XSS) vulnerability in SPIP 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) spip_login.php3 and (2) spip_pass.php3.
CVE-2006-0626 1 Spip 1 Spip 2026-04-16 N/A
SQL injection vulnerability in spip_acces_doc.php3 in SPIP 1.8.2g and earlier allows remote attackers to execute arbitrary SQL commands via the file parameter.
CVE-2006-1702 1 Spip 1 Spip 2026-04-16 N/A
PHP remote file inclusion vulnerability in spip_login.php3 in SPIP 1.8.3 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter.
CVE-2024-7954 1 Spip 1 Spip 2026-04-15 9.8 Critical
The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.
CVE-2023-53900 1 Spip 1 Spip 2026-04-07 8.8 High
Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Attackers can trick administrators into clicking a crafted SVG logo that redirects to a potentially dangerous URL through improper file upload filtering.
CVE-2025-71244 1 Spip 1 Spip 2026-03-05 6.1 Medium
SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a victim, redirects them to an arbitrary external site after login. This vulnerability only affects sites where the login page has been overridden to function in AJAX mode. It is not mitigated by the SPIP security screen.
CVE-2025-71242 1 Spip 1 Spip 2026-03-05 6.5 Medium
SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check authorization when displaying content of articles and sections (rubriques) in AJAX-loaded fragments, allowing an authenticated attacker to access restricted content. This vulnerability is not mitigated by the SPIP security screen.
CVE-2025-71241 1 Spip 1 Spip 2026-03-05 6.1 Medium
SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by the 'transmettre' API is not properly sanitized, allowing an attacker to inject malicious scripts. This vulnerability is mitigated by the SPIP security screen.
CVE-2025-71240 1 Spip 1 Spip 2026-03-05 5.4 Medium
SPIP before 4.2.15 allows Cross-Site Scripting (XSS) via crafted content in HTML code tags. The application does not properly verify JavaScript within code tags, allowing an attacker to inject malicious scripts that execute in a victim's browser.
CVE-2025-71247 1 Spip 1 Spip 2026-02-20 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2025-71248 1 Spip 1 Spip 2026-02-20 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2025-71249 1 Spip 1 Spip 2026-02-20 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2025-71250 1 Spip 1 Spip 2026-02-20 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2024-8517 1 Spip 1 Spip 2025-11-22 9.8 Critical
SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.
CVE-2024-53619 1 Spip 1 Spip 2025-07-07 6.3 Medium
An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file.
CVE-2024-53620 1 Spip 1 Spip 2025-07-03 4.8 Medium
A cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Title parameter.
CVE-2023-52322 1 Spip 1 Spip 2025-06-03 6.1 Medium
ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics.
CVE-2024-23659 1 Spip 1 Spip 2025-06-02 6.1 Medium
SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js.