İçeriğe atla
Noroxi

SPIP kayıtları

spip üreticisine ait 76 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
5 · %6,6
Pre-auth RCE
19
Düzeltme kaydı olan
%96,1
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 16
  2. 17
  3. 19
  4. 20
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

76 kayıt
  • CVE-2023-27372
    69Bu hafta

    SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled.

    KritikCVSS 9,8SilahlaştırılmışEPSS %100

    spip · spip28 Şub 2023

  • CVE-2024-8517
    67Bu hafta

    SPIP Bigup Multipart File Upload OS Command Injection

    KritikCVSS 9,8SilahlaştırılmışEPSS %95

    spip · spip6 Eyl 2024

  • CVE-2024-7954
    66Bu hafta

    SPIP porte_plume Plugin Arbitrary PHP Execution

    KritikCVSS 9,8SilahlaştırılmışEPSS %90

    spip · spip23 Ağu 2024

  • CVE-2022-37155
    47Planlayın

    RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.

    YüksekCVSS 8,8İstismar yokEPSS %40

    spip · spip13 Ara 2022

  • CVE-2017-9736
    40Planlayın

    SPIP 3.1.x before 3.1.6 and 3.2.x before Beta 3 does not remove shell metacharacters from the host field, allowing a remote attacker to caus

    KritikCVSS 9,8İstismar yokEPSS %3

    spip · spip17 Haz 2017

  • CVE-2020-28984
    40Planlayın

    prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, displ

    KritikCVSS 9,8İstismar yokEPSS %2

    spip · spip23 Kas 2020

  • CVE-2016-3154
    40Planlayın

    The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows r

    KritikCVSS 9,8İstismar yokEPSS %2

    spip · spip8 Nis 2016

  • CVE-2016-3153
    40Planlayın

    SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content,

    KritikCVSS 9,8İstismar yokEPSS %2

    spip · spip8 Nis 2016

  • CVE-2008-5812
    40Planlayın

    Multiple unspecified vulnerabilities in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 have unknown impact and attack vecto

    KritikCVSS 10,0İstismar yokEPSS %2

    spip · spip2 Oca 2009

  • CVE-2012-4331
    40Planlayın

    Multiple unspecified vulnerabilities in SPIP before 1.9.2.o, 2.0.x before 2.0.18, and 2.1.x before 2.1.13 have unknown impact and attack vec

    KritikCVSS 10,0İstismar yokEPSS %1

    spip · spip14 Ağu 2012

  • CVE-2016-7998
    39İzleyin

    The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a

    YüksekCVSS 8,8Kavram kanıtıEPSS %14

    spip · spip18 Oca 2017

  • CVE-2025-71243
    39İzleyin

    SPIP Saisies Plugin < 5.11.1 Remote Code Execution

    KritikCVSS 9,3SilahlaştırılmışEPSS %5

    spip · saisies19 Şub 2026

  • CVE-2023-24258
    39İzleyin

    SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter.

    KritikCVSS 9,8İstismar yokEPSS %2

    spip · spip27 Şub 2023

  • CVE-2013-4557
    38İzleyin

    The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers

    YüksekCVSS 7,5SilahlaştırılmışEPSS %25

    spip · spip17 Kas 2013

  • CVE-2026-27744
    37İzleyin

    SPIP tickets < 4.3.3 Unauthenticated RCE

    KritikCVSS 9,3İstismar yokEPSS %1

    spip · tickets25 Şub 2026

  • CVE-2026-27743
    37İzleyin

    SPIP referer_spam < 1.3.0 Unauthenticated SQL Injection

    KritikCVSS 9,3İstismar yokEPSS %1

    spip · referer spam25 Şub 2026

  • CVE-2016-7982
    36İzleyin

    Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on

    YüksekCVSS 7,5Kavram kanıtıEPSS %21

    spip · spip18 Oca 2017

  • CVE-2016-7980
    36İzleyin

    Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack t

    YüksekCVSS 8,8Kavram kanıtıEPSS %4

    spip · spip18 Oca 2017

  • CVE-2022-26846
    36İzleyin

    SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code.

    YüksekCVSS 8,8İstismar yokEPSS %3

    spip · spip10 Mar 2022

  • CVE-2019-11071
    36İzleyin

    SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri i

    YüksekCVSS 8,8İstismar yokEPSS %3

    spip · spip10 Nis 2019

  • CVE-2021-44123
    36İzleyin

    SPIP 4.0.0 is affected by a remote command execution vulnerability.

    YüksekCVSS 8,8İstismar yokEPSS %2

    spip · spip26 Oca 2022

  • CVE-2022-28960
    36İzleyin

    A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire.

    YüksekCVSS 8,8İstismar yokEPSS %2

    spip · spip19 May 2022

  • CVE-2022-28961
    36İzleyin

    Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where

    YüksekCVSS 8,8İstismar yokEPSS %2

    spip · spip19 May 2022

  • CVE-2026-27475
    36İzleyin

    SPIP < 4.4.9 Insecure Deserialization

    KritikCVSS 9,2Kavram kanıtıEPSS %1

    spip · spip19 Şub 2026

  • CVE-2021-44122
    35İzleyin

    SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrir

    YüksekCVSS 8,8İstismar yokEPSS %0

    spip · spip26 Oca 2022