Vulnerabilities > Spip
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-04-10 | CVE-2019-11071 | Improper Input Validation vulnerability in multiple products SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled. | 6.5 |
| 2017-10-22 | CVE-2017-15736 | Cross-site Scripting vulnerability in Spip Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as demonstrated by a PGP field, related to prive/objets/contenu/auteur.html and ecrire/inc/texte_mini.php. | 4.3 |
| 2017-06-17 | CVE-2017-9736 | OS Command Injection vulnerability in Spip SPIP 3.1.x before 3.1.6 and 3.2.x before Beta 3 does not remove shell metacharacters from the host field, allowing a remote attacker to cause remote code execution. | 7.5 |
| 2017-01-18 | CVE-2016-7999 | Server-Side Request Forgery (SSRF) vulnerability in Spip ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url parameter in a valider_xml action. | 4.3 |
| 2017-01-18 | CVE-2016-7998 | Improper Input Validation vulnerability in Spip The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted (1) INCLUDE or (2) INCLURE tag and then accessing it with a valider_xml action. | 6.5 |
| 2017-01-18 | CVE-2016-7982 | Path Traversal vulnerability in Spip Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the var_url parameter in a valider_xml action. | 5.0 |
| 2017-01-18 | CVE-2016-7981 | Cross-site Scripting vulnerability in Spip Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action. | 4.3 |
| 2017-01-18 | CVE-2016-7980 | Cross-Site Request Forgery (CSRF) vulnerability in Spip Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted valider_xml request. | 6.8 |
| 2016-12-17 | CVE-2016-9998 | Cross-site Scripting vulnerability in Spip SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/info_plugin.php involving the `$plugin` parameter, as demonstrated by a /ecrire/?exec=info_plugin URL. | 4.3 |
| 2016-12-17 | CVE-2016-9997 | Cross-site Scripting vulnerability in Spip SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/puce_statut.php involving the `$id` parameter, as demonstrated by a /ecrire/?exec=puce_statut URL. | 4.3 |