SPIP vulnerabilities
34 published CVEs name SPIP among the affected products.
- 34Published CVEs34 of them scored
- 32Last 12 monthspublished in the last year
- 12Critical9 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-122032
SPIP before 4.4.29 Authenticated SQL Injection via where Parameter
SPIP · SPIP
High7.1 - CVE-2026-109378
SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url
SPIP · SPIP
Medium5.3 - CVE-2026-104070
SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE
SPIP · SPIP Crayons Plugin
Critical9.3 - CVE-2026-72710
SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection
SPIP · SPIP
Critical9.3 - CVE-2026-72709
SPIP < 4.4.18 Missing Authorization via ecrire/action/
SPIP · SPIP
Critical9.3 - CVE-2026-72708
SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html
SPIP · SPIP
High8.7 - CVE-2026-77806
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code…
SPIP · SPIP
Critical9.8 - CVE-2026-77647
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect…
SPIP · SPIP
Critical9.8 - CVE-2026-66738
SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite
SPIP · SPIP
High7.7 - CVE-2026-48832
action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability.
SPIP · SPIP
Low3.5