CVEs we hold for Spip
Records whose assigning authority named Spip as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-8429SPIP < 4.4.14 Remote Code Execution via Private SpaceSPIP CVE-2026-72710SPIP < 4.4.18 RCE via editer_objet.php Job Queue InjectionSPIP CVE-2026-72709SPIP < 4.4.18 Missing Authorization via ecrire/action/SPIP CVE-2026-72708SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.htmlSPIP CVE-2026-66738SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLiteSPIP CVE-2026-27747SPIP interface_traduction_objets < 2.2.2 Authenticated SQL InjectionSPIP interface_traduction_objets CVE-2026-27746SPIP jeux < 4.1.1 Reflected XSS via index ParametersSPIP jeux CVE-2026-27745SPIP interface_traduction_objets < 2.2.2 Authenticated RCESPIP interface_traduction_objets CVE-2026-27743SPIP referer_spam < 1.3.0 Unauthenticated SQL InjectionSPIP referer_spam CVE-2026-27474SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)SPIP CVE-2026-27473SPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated SitesSPIP CVE-2026-27472SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated SitesSPIP CVE-2026-26223SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private AreaSPIP CVE-2026-22206SPIP < 4.4.10 SQL Injection RCE via Union & PHP TagsSPIP CVE-2026-22205SPIP < 4.4.10 Authentication Bypass via PHP Type JugglingSPIP CVE-2025-71243SPIP Saisies Plugin < 5.11.1 Remote Code ExecutionSPIP Saisies pour formulaire CVE-2025-71242SPIP < 4.3.6 Authorization Bypass Leading to Content DisclosureSPIP CVE-2024-8517SPIP Bigup Multipart File Upload OS Command InjectionSPIP CVE-2023-53900Spip 4.1.10 Admin Account Spoofing via Malicious SVG Uploadspip 31 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.