Browse CVEs

MEDIUM 5.4 CVE-2021-44118 SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. Th… Spip Patch available Fix from $1,6002022-01-26 MEDIUM 5.4 CVE-2021-44120 SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable … Spip Patch available Fix from $1,6002022-01-26 MEDIUM 6.1 CVE-2017-15736 Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted s… Spip after 3.1.6 Fix from $1,6002017-10-22 CRITICAL 9.8 CVE-2017-9736 SPIP 3.1.x before 3.1.6 and 3.2.x before Beta 3 does not remove shell metacharacters from the host field, allowing a remote attacker to cause remote … Spip Patch available Fix from $2,3002017-06-17 HIGH 8.8 CVE-2016-7998EPSS 14% The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML fi… Spip after 3.1.2 Fix from $1,9502017-01-18 HIGH 7.4 CVE-2016-7999 ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the … Spip after 3.1.2 Fix from $1,9502017-01-18 HIGH 8.8 CVE-2016-7980 Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authen… Spip after 3.1.2 Fix from $1,9502017-01-18 HIGH 7.5 CVE-2016-7982EPSS 21% Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the syst… Spip after 3.1.2 Fix from $1,9502017-01-18 MEDIUM 6.1 CVE-2016-7981EPSS 8% Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML … Spip after 3.1.2 Fix from $1,6002017-01-18 MEDIUM 6.1 CVE-2016-9997 SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/puce_statut.php involving the `$id` parameter, as demonstrated… Spip Patch available Fix from $1,6002016-12-17 MEDIUM 6.1 CVE-2016-9998 SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/info_plugin.php involving the `$plugin` parameter, as demonstra… Spip Patch available Fix from $1,6002016-12-17 MEDIUM 6.1 CVE-2016-9152 Cross-site scripting (XSS) vulnerability in ecrire/exec/plonger.php in SPIP 3.1.3 allows remote attackers to inject arbitrary web script or HTML via … Spip Patch available Fix from $1,6002016-12-05 CRITICAL 9.8 CVE-2016-3154 The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote att… Spip Patch available Fix from $2,3002016-04-08 HIGH 7.5 CVE-2013-4557EPSS 25% The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execu… Spip Patch available Fix from $1,9502013-11-18 MEDIUM 6.8 CVE-2013-4555 Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authenticatio… Spip after 2.1.23 Fix from $1,6002013-11-18 HIGH 7.5 CVE-2013-2118EPSS 9% SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "take editorial control" via vec… Spip Mitigation only Fix from $1,9502013-07-09 HIGH 10.0 CVE-2012-4331 Multiple unspecified vulnerabilities in SPIP before 1.9.2.o, 2.0.x before 2.0.18, and 2.1.x before 2.1.13 have unknown impact and attack vectors that… Spip No fix yet Fix from $1,9502012-08-14 HIGH 7.5 CVE-2009-3041EPSS 7% SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire/exec/install.php and (2) ecrire/index.php, which all… Spip Patch available Fix from $1,9502009-09-01 HIGH 10.0 CVE-2008-5812 Multiple unspecified vulnerabilities in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 have unknown impact and attack vectors. Spip Patch available Fix from $1,9502009-01-02 HIGH 7.5 CVE-2008-5813 SQL injection vulnerability in inc/rubriques.php in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 allows remote attackers to execut… Spip Patch available Fix from $1,9502009-01-02 HIGH 7.5 CVE-2007-4525 PHP remote file inclusion vulnerability in inc-calcul.php3 in SPIP 1.7.2 allows remote attackers to execute arbitrary PHP code via a URL in the squel… Spip Mitigation only Fix from $1,9502007-08-25 HIGH 7.5 CVE-2006-1702 PHP remote file inclusion vulnerability in spip_login.php3 in SPIP 1.8.3 allows remote attackers to execute arbitrary PHP code via a URL in the url p… Spip No fix yet Fix from $1,9502006-04-11 HIGH 7.5 CVE-2006-0626 SQL injection vulnerability in spip_acces_doc.php3 in SPIP 1.8.2g and earlier allows remote attackers to execute arbitrary SQL commands via the file … Spip No fix yet Fix from $1,9502006-02-09 MEDIUM 6.4 CVE-2006-0625 Directory traversal vulnerability in Spip_RSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via ".." seq… Spip No fix yet Fix from $1,6002006-02-09 HIGH 7.5 CVE-2006-0517 Multiple SQL injection vulnerabilities in formulaires/inc-formulaire_forum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allow … Spip after 1.9_alpha2_5539 Fix from $1,9502006-02-02 MEDIUM 5.0 CVE-2006-0519 SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messf… Spip after 1.9_alpha2_5539 Fix from $1,6002006-02-02