Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-22206

SPIP < 4.4.10 SQL Injection RCE via Union & PHP Tags

SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw combined with PHP tag processing to achieve remote code execution on the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Spip
Products
Saisies Spip
CVE-2026-22205

SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Spip
Products
Saisies Spip
CVE-2025-71243

SPIP Saisies Plugin < 5.11.1 Remote Code Execution

The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately update to version 5.11.1 or later.

CVSS 4.0 · 9.3 Critical EPSS 5.6% KEV · Not listed
Vendors
Spip
Products
Saisies Saisies Pour Formulaire