CVE-2025-71240

SPIP < 4.2.15 Cross-Site Scripting via Code Tags

CVSS 4.8 MEDIUMEPSS 0.2%CWE-79

SPIP before 4.2.15 allows Cross-Site Scripting (XSS) via crafted content in HTML code tags. The application does not properly verify JavaScript within code tags, allowing an attacker to inject malicious scripts that execute in a victim's browser.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected products

SPIP · SPIP

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://blog.spip.net/Mise-a-jour-de-maintenance-et-securite-sortie-de-SPIP-4-2-15.html https://git.spip.net/spip/spip https://www.vulncheck.com/advisories/spip-cross-site-scripting-via-code-tags