Exposição de SPIP

CMS
61
score de exposição
1.789
sites usam
0
em exploração
8
críticos
Análise Vexday

O SPIP, sistema gerenciador de conteúdo de código aberto, acumula 19 CVEs catalogadas, das quais 4 são de severidade crítica e nenhuma consta atualmente no catálogo de exploração ativa da CISA KEV — taxa abaixo da média geral do catálogo. Ainda assim, o cenário exige atenção: o maior EPSS observado chega a 0,946, valor atribuído à CVE-2024-8517, indicando probabilidade muito elevada de exploração real a curto prazo conforme modelos preditivos. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que aponta para deficiências recorrentes no tratamento de entradas e saídas na aplicação. O surgimento de 3 novas CVEs nos últimos 90 dias sugere uma superfície de ataque ainda em expansão, recomendando atenção contínua à aplicação de patches e à revisão de configurações de sanitização de dados.

CVEs

25 resultados
CVE-2024-8517CRITICALSPIP Bigup Multipart File Upload OS Command InjectionEPSS 94.6%CVE-2024-7954CRITICALSPIP porte_plume Plugin Arbitrary PHP ExecutionEPSS 90.1%CVE-2026-77806CRITICALSPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is relatEPSS 4.2%CVE-2026-77647CRITICALSPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is relatEPSS 2.6%CVE-2026-27475CRITICALSPIP < 4.4.9 Insecure DeserializationEPSS 0.8%CVE-2026-72710CRITICALSPIP < 4.4.18 RCE via editer_objet.php Job Queue InjectionEPSS 0.6%CVE-2026-22206HIGHSPIP < 4.4.10 SQL Injection RCE via Union & PHP TagsEPSS 0.6%CVE-2026-8429HIGHSPIP < 4.4.14 Remote Code Execution via Private SpaceEPSS 0.5%CVE-2026-22205HIGHSPIP < 4.4.10 Authentication Bypass via PHP Type JugglingEPSS 0.5%CVE-2026-8430CRITICALSPIP < 4.4.14 Remote Code Execution via nginxEPSS 0.4%CVE-2026-66738HIGHSPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLiteEPSS 0.4%CVE-2026-72709CRITICALSPIP < 4.4.18 Missing Authorization via ecrire/action/EPSS 0.4%CVE-2026-72708HIGHSPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.htmlEPSS 0.3%CVE-2023-53900MEDIUMSpip 4.1.10 Admin Account Spoofing via Malicious SVG UploadEPSS 0.3%CVE-2026-27472MEDIUMSPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated SitesEPSS 0.3%CVE-2026-27473MEDIUMSPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated SitesEPSS 0.3%CVE-2025-71242MEDIUMSPIP < 4.3.6 Authorization Bypass Leading to Content DisclosureEPSS 0.3%CVE-2026-27474MEDIUMSPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)EPSS 0.3%CVE-2026-33549MEDIUMSPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an authoEPSS 0.2%CVE-2025-71241MEDIUMSPIP < 4.3.6 Cross-Site Scripting in Private AreaEPSS 0.2%