SPIP CMS < 4.1.16 / 4.2.x < 4.2.13 / 4.3.x < 4.3.0-alpha2 Remote Code Execution

The SPIP CMS versions prior to 4.1.16 or 4.2.x prior to 4.2.13 or 4.3.x prior to 4.3.0-alpha2 are vulnerable to an unauthenticated Remote Code Execution through the 'porteplume' plugin by sending a specially forged HTTP request. No source data...

Ubuntu: Security Advisory (USN-7318-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-7318-1: SPIP vulnerabilities

It was discovered that svg-sanitizer, vendored in SPIP, did not properly sanitize SVG/XML content. An attacker could possibly use this issue to perform cross site scripting. This issue only affected Ubuntu 24.10. CVE-2022-23638 It was discovered that SPIP did not properly sanitize certain inputs....

USN-7318-1 spip vulnerabilities

It was discovered that svg-sanitizer, vendored in SPIP, did not properly sanitize SVG/XML content. An attacker could possibly use this issue to perform cross site scripting. This issue only affected Ubuntu 24.10. CVE-2022-23638 It was discovered that SPIP did not properly sanitize certain inputs....

Ubuntu 18.04 LTS / 20.04 LTS / 24.10 : SPIP vulnerabilities (USN-7318-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7318-1 advisory. It was discovered that svg-sanitizer, vendored in SPIP, did not properly sanitize SVG/XML content. An attacker could possibly use thi...

Exploit for CVE-2024-7954

RCE-CVE-2024-7954 Description The porteplume plugin,...

CVE-2024-7954

The porteplume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request...

CVE-2024-8517

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request...

PT-2026-20838

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.2.15 Description The application does not properly validate JavaScript within HTML code tags, which allows for the injection of malicious scripts that execute in a victim’s browser. This can lead to Cross-Site Scriptin...

PT-2026-20840

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.3.6 SPIP versions prior to 4.2.17 SPIP versions prior to 4.1.20 Description The application does not properly verify authorization when displaying content of articles and sections rubriques in AJAX-loaded fragments,...

PT-2026-20839

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.3.6 SPIP versions prior to 4.2.17 SPIP versions prior to 4.1.20 Description SPIP versions prior to 4.3.6, 4.2.17, and 4.1.20 contain a Cross-Site Scripting XSS issue within the private area. The error message displayed...

PT-2026-20842

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.3.9 SPIP versions 4.3.9 through 4.4.5 Description The software contains a flaw that allows an attacker to redirect a user to a malicious external site after they log in, specifically when the site is configured to use...

Exploit for CVE-2024-7954

RCECVE-2024-7954- The porteplume plugin used by SPIP before...

CVE-2024-53620

A cross-site scripting XSS vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Title parameter...

CVE-2024-53620

A cross-site scripting XSS vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Title parameter...

UBUNTU-CVE-2024-53619

An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file...

UBUNTU-CVE-2024-53620

A cross-site scripting XSS vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Title parameter...

CVE-2024-53619

An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file...

SPIP 安全漏洞

SPIP is a free software for creating Internet sites from SPIP Open Source. A security vulnerability exists in SPIP v4.3.3, which originates from a cross-site scripting vulnerability in the Article module...

PT-2024-35793 · Spip · Spip

Name of the Vulnerable Software and Affected Versions: SPIP version 4.3.3 Description: The issue concerns an authenticated arbitrary file upload vulnerability in the Documents module. This allows attackers to execute arbitrary code by uploading a crafted PDF file. There is no information provided...