CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

PT-2026-69854

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description In installations using SQLite, the navigation menu endpoint improperly handles array-typed user input. This flaw bypasses input sanitization, allowing the input to break out of an internal quoted strin...

SPIP Unauthenticated Blind SQLi via Date Field Escaping Bypass

This module exploits an unauthenticated blind SQL injection in SPIP use auxiliary/scanner/http/spip/anneesqli msf undefinedanneesqli show actions ...actions... msf undefinedanneesqli set ACTION msf undefinedanneesqli show options ...show and set options... msf undefinedanneesqli run This module...

Linux Distros Unpatched Vulnerability : CVE-2026-66738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user inpu...

CVE-2026-66738: Improper Control of Generation of Code

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

SPIP <3.1.2 - Cross-Site Scripting Detection

SPIP 3.1.2 and earlier contains a cross-site scripting vulnerability in validerxml.php which allows remote attackers to inject arbitrary web script or HTML via the varurl parameter in a validerxml action. !/usr/bin/env python3 -- coding: utf-8 -- """SPIP 3.""" from kittysploit import from...

SPIP Porte Plume Plugin - Remote Code Execution Detection

The porteplume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. !/usr/bin/env python3 -- coding: utf-8 -- """Th...

SPIP Install - Exposure Detection

SPIP is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """SPIP is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Exploit for Cross-site Scripting in Spip

SPIP-CVE-2024-...

[SECURITY] [DLA 4659-1] debian-security-support update

Debian LTS Advisory DLA-4659-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón June 30, 2026 https://wiki.debian.org/LTS Package : debian-security-support Version : 1:11+2026.06.30 Debian Bug : 1109118 1121942 1135153 debian-security-support, the Debian...

Debian dla-4659 : debian-security-support - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4659 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4659-1 [email protected] https://www.debian.org/lts/security/...

CVE-2026-48832

action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability...

Debian dsa-6296 : spip - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6296 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6296-1 [email protected] https://www.debian.org/securit...

Malicious code in spip-pth-demo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb61035c28fe642903fac1b2776b2593c1611831ce5553e63ef8b09a77e414c9 The package installs a suspicious-demo.pth file into site-packages via setup.py's datafiles="", "suspicious-demo.pth". Python auto-processes.pth file...

MAL-2026-4770 Malicious code in spip-pth-demo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb61035c28fe642903fac1b2776b2593c1611831ce5553e63ef8b09a77e414c9 The package installs a suspicious-demo.pth file into site-packages via setup.py's datafiles="", "suspicious-demo.pth". Python auto-processes.pth file...

[SECURITY] [DSA 6296-1] spip security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6296-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 25, 2026 https://www.debian.org/security/faq -...

Linux Distros Unpatched Vulnerability : CVE-2026-48832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability. CVE-2026-48832 Note that Nessus relies on the presence of the...

DEBIAN-CVE-2026-48832

action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability...

CVE-2026-48832

action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability...

CVE-2026-48832

action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability...