1294 matches found
DEBIAN-CVE-2026-77647
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of ?php blocks, and varexport's mishandling of certain cases such as presence of a '' character...
CVE-2026-77647
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of ?php blocks, and varexport's mishandling of certain cases such as presence of a '' character...
CVE-2026-77647
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of ?php blocks, and varexport's mishandling of certain cases such as presence of a '' character...
CVE-2026-77647
SPIP before 4.4.20 is vulnerable to unauthenticated remote code execution (CVSS 9.8, CRITICAL). The root cause is an incorrect identification of <?php blocks combined with var_export's mishandling of certain cases involving a
VulnCheck KEV: CVE-2026-77647
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of ?php blocks, and varexport's mishandling of certain cases such as presence of a '' character...
PT-2026-79386
Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.21 Description Unauthenticated remote attackers can execute arbitrary code due to a code injection flaw. This issue occurs when the analyse resultat skel function mishandles the X-Spip-Filtre HTTP request header. Thi...
PT-2026-79268
Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.20 Description Unauthenticated remote attackers can execute arbitrary code due to the incorrect identification of ?php blocks and the mishandling of certain cases, such as the presence of a character, within the var...
CVE-2026-66738
SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...
CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite
SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...
EUVD-2026-55655
SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...
CVE-2026-66738
SPIP prior to 4.4.18 on SQLite-backed installations contains a code injection vulnerability in the navigation endpoint. The endpoint mishandles array-typed user input, bypasses input sanitization, and can break out of a PHP-quoted string context, enabling an authenticated attacker (minimum editor...
CVE-2026-66738
SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...
Linux Distros Unpatched Vulnerability : CVE-2026-66738
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user inpu...
[SECURITY] [DLA 4659-1] debian-security-support update
Debian LTS Advisory DLA-4659-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón June 30, 2026 https://wiki.debian.org/LTS Package : debian-security-support Version : 1:11+2026.06.30 Debian Bug : 1109118 1121942 1135153 debian-security-support, the Debian...
CVE-2026-48832
action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability...
Debian dsa-6296 : spip - security update
The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6296 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6296-1 [email protected] https://www.debian.org/securit...
Malicious code in spip-pth-demo (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb61035c28fe642903fac1b2776b2593c1611831ce5553e63ef8b09a77e414c9 The package installs a suspicious-demo.pth file into site-packages via setup.py's datafiles="", "suspicious-demo.pth". Python auto-processes.pth file...
MAL-2026-4770 Malicious code in spip-pth-demo (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb61035c28fe642903fac1b2776b2593c1611831ce5553e63ef8b09a77e414c9 The package installs a suspicious-demo.pth file into site-packages via setup.py's datafiles="", "suspicious-demo.pth". Python auto-processes.pth file...
[SECURITY] [DSA 6296-1] spip security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6296-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 25, 2026 https://www.debian.org/security/faq -...
Linux Distros Unpatched Vulnerability : CVE-2026-48832
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability. CVE-2026-48832 Note that Nessus relies on the presence of the...