Spip vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-104070 The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable objecCritical 9.3 · Oct 6, 2026
• CVE-2026-72710 SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet action that allows unauthenticated attackers to write arbitrary rows to any SQL Critical 9.3 · Sep 11, 2026
• CVE-2026-72709 SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invCritical 9.3 · Sep 11, 2026
• CVE-2026-72708 SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitHigh 8.7 · Sep 11, 2026
• CVE-2026-77806 SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026.Critical 9.8 · Aug 21, 2026
• CVE-2026-77647 SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026.Critical 9.8 · Aug 20, 2026
• CVE-2026-66738 SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations.High 7.7 · Aug 10, 2026
• CVE-2026-8430 SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackCritical 9.2 · May 12, 2026
• CVE-2026-8429 SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context High 8.7 · May 12, 2026
• CVE-2026-22206 SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulatiHigh 8.7 · Feb 26, 2026
• CVE-2026-22205 SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protectHigh 8.7 · Feb 26, 2026
• CVE-2026-27747 The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated SQL injection vulnerability in interface_traduction_objets_pipelineHigh 7.1 · Feb 24, 2026
• CVE-2026-27745 The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated remote code execution vulnerability in the translation interface woHigh 8.7 · Feb 24, 2026
• CVE-2026-27744 The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pCritical 9.3 · Feb 24, 2026
• CVE-2026-27743 The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimCritical 9.3 · Feb 24, 2026
• CVE-2026-27475 SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data.Critical 9.2 · Feb 19, 2026
• CVE-2026-26345 SPIP before 4.4.8 contains a stored cross-site scripting (XSS) vulnerability in the public area triggered in certain edge-case usage patterns.High 8.6 · Feb 19, 2026
• CVE-2025-71243 The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability.Critical 9.3 · Feb 19, 2026
• CVE-2024-8517 SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue.Critical 9.8 · Sep 6, 2024
• CVE-2024-7954 The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability.Critical 9.8 · Aug 23, 2024
• CVE-2023-27372 SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled.Critical 9.8 · Feb 28, 2023
• CVE-2023-24258 SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter.Critical 9.8 · Feb 27, 2023
• CVE-2022-37155 RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.High 8.8 · Dec 13, 2022
• CVE-2022-28961 Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters.High 8.8 · May 19, 2022
• CVE-2022-28960 A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire.High 8.8 · May 19, 2022