EUVD-2026-76154

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the public sitemap endpoint where the MySQL escaper spipmysqlcite in ecrire/req/mysql.php returns values unescaped when the target column is a date type and the supplied value matches the pattern of a word charact...

CVE-2026-72708

SPIP before 4.4.18 is affected by an unauthenticated blind SQL injection in the public sitemap endpoint. The root cause lies in the MySQL escaper spip_mysql_cite() (in ecrire/req/mysql.php), which returns values unescaped when the target column is a date type and the input matches a word characte...

CVE-2026-4907 Page-Replica Page Replica Endpoint sitemap sitemap.fetch server-side request forgery

A vulnerability was identified in Page-Replica Page Replica up to e4a7f52e75093ee318b4d5a9a9db6751050d2ad0. The impacted element is the function sitemap.fetch of the file /sitemap of the component Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack is...