CVE-2023-52322

SPIP is affected by a cross-site scripting (XSS) vulnerability in ecrire/public/assembler.php, due to unsanitized input from _request() being allowed outside safe characters. The issue affects SPIP versions prior to 4.1.13 and 4.2.x prior to 4.2.7. In practice, attacker-controlled input can be re...

CVE-2023-52322

ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from request is not restricted to safe characters such as alphanumerics...

PT-2024-14522 · Spip · Spip

Name of the Vulnerable Software and Affected Versions: SPIP versions 4.1.3 and earlier SPIP versions 4.2.x through 4.2.6 Description: The issue arises from the ecrire/public/assembler.php file in SPIP, where input from request is not restricted to safe characters, such as alphanumerics, allowing...

[SECURITY] [DLA 3691-1] spip security update

Debian LTS Advisory DLA-3691-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin December 18, 2023 https://wiki.debian.org/LTS Package : spip Version : 3.2.4-1+deb10u12 Multiple security issues were discovered in SPIP, a content management system, which could lead to...

Debian: Security Advisory (DLA-3691-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian dla-3691 : spip - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3691 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3691-1 [email protected] https://www.debian.org/lts/security/...

DLA-3691-1 spip - security update

Bulletin has no description...

The vulnerability of the SPIP content management system, related to the restoration of unreliable data in memory, allows a hacker to execute arbitrary code.

The vulnerability of the SPIP content management system is related to the restoration of unreliable data in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code using specially created data transmitted to the application...

Exploit for Deserialization of Untrusted Data in Spip

This is a proof of concept CVE-2023-27372 SPIP RCE vulnerabi...

Exploit for Deserialization of Untrusted Data in Spip

CVE-2023-27372 - The vulnerability exists in the oubli parame...

Exploit for Deserialization of Untrusted Data in Spip

CVE-2023-27372 - The vulnerability exists in the oubli parame...

Exploit for Deserialization of Untrusted Data in Spip

CVE-2023-27372-POC Overview This Python POC Proof of Con...

Exploit for Deserialization of Untrusted Data in Spip

This PoC was wrote quickly, it's nothing special. This e...

Exploit for Deserialization of Untrusted Data in Spip

This PoC was wrote quickly, it's nothing special. This e...

SPIP v4.1.10 - Spoofing Admin account Vulnerability

Exploit Title: spip v4.1.10 - Spoofing Admin account Author: nu11secur1ty Vendor: https://www.spip.net/enrubrique25.html Software: https://files.spip.net/spip/archives/spip-v4.1.10.zip Reference: https://www.crowdstrike.com/cybersecurity-101/spoofing-attacks/ Description: The malicious user can...

spip v4.1.10 - Spoofing Admin account

Exploit Title: spip v4.1.10 - Spoofing Admin account Author: nu11secur1ty Date: 06.29.2023 Vendor: https://www.spip.net/enrubrique25.html Software: https://files.spip.net/spip/archives/spip-v4.1.10.zip Reference: https://www.crowdstrike.com/cybersecurity-101/spoofing-attacks/ Description: The...

SPIP v4.2.0 - Remote Code Execution (Unauthenticated) Exploit

!/usr/bin/env python3 -- coding: utf-8 -- Exploit Title: SPIP v4.2.1 - Remote Code Execution Unauthenticated Google Dork: inurl:"/spip.php?page=login" Exploit Author: nuts7 https://github.com/nuts7/CVE-2023-27372 Vendor Homepage: https://www.spip.net/ Software Link:...

Exploit for Deserialization of Untrusted Data in Spip

CVE-2023-27372 SPIP -v -o report.txt 🔍 Reconnaissance M...

SPIP password reset serialization vulnerability

Added: 06/23/2023 Background SPIP is a web-based publishing system written in PHP. Problem Mishandling of serialized data in SPIP's password reset form allows remote attackers to execute arbitrary commands. Resolution Upgrade to SPIP 3.2.18, 4.0.10, 4.1.8, 4.2.1 or higher. References...

SPIP password reset serialization vulnerability

Added: 06/23/2023 Background SPIP is a web-based publishing system written in PHP. Problem Mishandling of serialized data in SPIP's password reset form allows remote attackers to execute arbitrary commands. Resolution Upgrade to SPIP 3.2.18, 4.0.10, 4.1.8, 4.2.1 or higher. References...