Vulnerabilities in SPIP
34 resultsCVE-2026-122032HIGHSPIP before 4.4.29 Authenticated SQL Injection via where ParameterEPSS 0.3%CVE-2025-71241MEDIUMSPIP < 4.3.6 Cross-Site Scripting in Private AreaEPSS 0.3%CVE-2023-53900MEDIUMSpip 4.1.10 Admin Account Spoofing via Malicious SVG UploadEPSS 0.3%CVE-2026-27472MEDIUMSPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated SitesEPSS 0.3%CVE-2026-27473MEDIUMSPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated SitesEPSS 0.3%CVE-2026-27474MEDIUMSPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)EPSS 0.3%CVE-2026-33549MEDIUMSPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an authoEPSS 0.2%CVE-2026-109378MEDIUMSPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_urlEPSS 0.2%CVE-2026-27746MEDIUMSPIP jeux < 4.1.1 Reflected XSS via index ParametersEPSS 0.2%CVE-2025-71244MEDIUMSPIP < 4.4.5 Open Redirect via Login FormEPSS 0.2%CVE-2026-26223MEDIUMSPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private AreaEPSS 0.2%CVE-2026-26345HIGHSPIP < 4.4.8 Cross-Site Scripting in Public AreaEPSS 0.2%CVE-2025-71240MEDIUMSPIP < 4.2.15 Cross-Site Scripting via Code TagsEPSS 0.2%CVE-2026-48832LOWaction/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability.EPSS 0.2%