Spip

Spip

78 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.6

CVE-2026-26345

  • EPSS 0.07%
  • Veröffentlicht 19.02.2026 15:25:06
  • Zuletzt bearbeitet 24.02.2026 19:51:50

SPIP before 4.4.8 contains a stored cross-site scripting (XSS) vulnerability in the public area triggered in certain edge-case usage patterns. The echapper_html_suspect() function does not adequately sanitize user-controlled content, allowing authent...

8.1

CVE-2025-71250

  • EPSS -
  • Veröffentlicht 19.02.2026 14:58:20
  • Zuletzt bearbeitet 19.02.2026 19:22:28

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

5.4

CVE-2025-71249

  • EPSS -
  • Veröffentlicht 19.02.2026 14:58:20
  • Zuletzt bearbeitet 19.02.2026 19:22:28

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

6.4

CVE-2025-71248

  • EPSS -
  • Veröffentlicht 19.02.2026 14:58:19
  • Zuletzt bearbeitet 19.02.2026 19:22:28

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

4.3

CVE-2025-71247

  • EPSS -
  • Veröffentlicht 19.02.2026 14:58:18
  • Zuletzt bearbeitet 19.02.2026 19:22:27

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

4.7

CVE-2025-71246

  • EPSS -
  • Veröffentlicht 19.02.2026 14:58:17
  • Zuletzt bearbeitet 19.02.2026 16:27:12

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

5.4

CVE-2025-71245

  • EPSS -
  • Veröffentlicht 19.02.2026 14:58:16
  • Zuletzt bearbeitet 19.02.2026 16:27:12

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

6.1

CVE-2025-71244

  • EPSS 0.05%
  • Veröffentlicht 19.02.2026 14:58:16
  • Zuletzt bearbeitet 24.02.2026 19:27:15

SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a victim, redirects them to an arbitrary external site after login. This vulnerability only aff...

6.5

CVE-2025-71242

  • EPSS 0.04%
  • Veröffentlicht 19.02.2026 14:58:14
  • Zuletzt bearbeitet 02.03.2026 15:16:31

SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check authorization when displaying content of articles and sections (rubriques) in AJAX-loaded fragments, allowing an...

6.1

CVE-2025-71241

  • EPSS 0.04%
  • Veröffentlicht 19.02.2026 14:58:13
  • Zuletzt bearbeitet 02.03.2026 15:16:31

SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by the 'transmettre' API is not properly sanitized, allowing an attacker to inject malicious scripts. This vulnera...