Skip to content
Noroxi

SPIP records

76 published records for vendor spip.

Researcher profile

Entered KEV
0 · 0%
Weaponized
5 · 6.6%
Pre-auth RCE
19
With a fix record
96.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 16
  2. 17
  3. 19
  4. 20
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

76 records
  • CVE-2023-27372
    69This week

    SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled.

    CriticalCVSS 9.8WeaponizedEPSS 100%

    spip · spipFeb 28, 2023

  • CVE-2024-8517
    67This week

    SPIP Bigup Multipart File Upload OS Command Injection

    CriticalCVSS 9.8WeaponizedEPSS 95%

    spip · spipSep 6, 2024

  • CVE-2024-7954
    66This week

    SPIP porte_plume Plugin Arbitrary PHP Execution

    CriticalCVSS 9.8WeaponizedEPSS 90%

    spip · spipAug 23, 2024

  • CVE-2022-37155
    47Plan

    RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.

    HighCVSS 8.8No exploitEPSS 40%

    spip · spipDec 13, 2022

  • CVE-2017-9736
    40Plan

    SPIP 3.1.x before 3.1.6 and 3.2.x before Beta 3 does not remove shell metacharacters from the host field, allowing a remote attacker to caus

    CriticalCVSS 9.8No exploitEPSS 3%

    spip · spipJun 17, 2017

  • CVE-2020-28984
    40Plan

    prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, displ

    CriticalCVSS 9.8No exploitEPSS 2%

    spip · spipNov 23, 2020

  • CVE-2016-3154
    40Plan

    The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows r

    CriticalCVSS 9.8No exploitEPSS 2%

    spip · spipApr 8, 2016

  • CVE-2016-3153
    40Plan

    SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content,

    CriticalCVSS 9.8No exploitEPSS 2%

    spip · spipApr 8, 2016

  • CVE-2008-5812
    40Plan

    Multiple unspecified vulnerabilities in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 have unknown impact and attack vecto

    CriticalCVSS 10.0No exploitEPSS 2%

    spip · spipJan 2, 2009

  • CVE-2012-4331
    40Plan

    Multiple unspecified vulnerabilities in SPIP before 1.9.2.o, 2.0.x before 2.0.18, and 2.1.x before 2.1.13 have unknown impact and attack vec

    CriticalCVSS 10.0No exploitEPSS 1%

    spip · spipAug 14, 2012

  • CVE-2016-7998
    39Monitor

    The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a

    HighCVSS 8.8Proof of conceptEPSS 14%

    spip · spipJan 18, 2017

  • CVE-2025-71243
    39Monitor

    SPIP Saisies Plugin < 5.11.1 Remote Code Execution

    CriticalCVSS 9.3WeaponizedEPSS 5%

    spip · saisiesFeb 19, 2026

  • CVE-2023-24258
    39Monitor

    SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter.

    CriticalCVSS 9.8No exploitEPSS 2%

    spip · spipFeb 27, 2023

  • CVE-2013-4557
    38Monitor

    The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers

    HighCVSS 7.5WeaponizedEPSS 25%

    spip · spipNov 17, 2013

  • CVE-2026-27744
    37Monitor

    SPIP tickets < 4.3.3 Unauthenticated RCE

    CriticalCVSS 9.3No exploitEPSS 1%

    spip · ticketsFeb 25, 2026

  • CVE-2026-27743
    37Monitor

    SPIP referer_spam < 1.3.0 Unauthenticated SQL Injection

    CriticalCVSS 9.3No exploitEPSS 1%

    spip · referer spamFeb 25, 2026

  • CVE-2016-7982
    36Monitor

    Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on

    HighCVSS 7.5Proof of conceptEPSS 21%

    spip · spipJan 18, 2017

  • CVE-2016-7980
    36Monitor

    Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack t

    HighCVSS 8.8Proof of conceptEPSS 4%

    spip · spipJan 18, 2017

  • CVE-2022-26846
    36Monitor

    SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code.

    HighCVSS 8.8No exploitEPSS 3%

    spip · spipMar 10, 2022

  • CVE-2019-11071
    36Monitor

    SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri i

    HighCVSS 8.8No exploitEPSS 3%

    spip · spipApr 10, 2019

  • CVE-2021-44123
    36Monitor

    SPIP 4.0.0 is affected by a remote command execution vulnerability.

    HighCVSS 8.8No exploitEPSS 2%

    spip · spipJan 26, 2022

  • CVE-2022-28960
    36Monitor

    A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire.

    HighCVSS 8.8No exploitEPSS 2%

    spip · spipMay 19, 2022

  • CVE-2022-28961
    36Monitor

    Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where

    HighCVSS 8.8No exploitEPSS 2%

    spip · spipMay 19, 2022

  • CVE-2026-27475
    36Monitor

    SPIP < 4.4.9 Insecure Deserialization

    CriticalCVSS 9.2Proof of conceptEPSS 1%

    spip · spipFeb 19, 2026

  • CVE-2021-44122
    35Monitor

    SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrir

    HighCVSS 8.8No exploitEPSS 0%

    spip · spipJan 26, 2022