CVE-2026-72710 SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection

SPIP before 4.4.18 contains a mass assignment vulnerability in the editerobjet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champseditables allowlist by supplying an attacker-controlled arg parameter resolving to internal database tables. Attacke...