Vulnerabilities

TI-2026-21882 CVE-2026-27475 · GHSA-hxjp-v4qc-fcjg

SPIP < 4.4.9 Insecure Deserialization

MEDIUM 43

SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0091 Published 2026-02-19 Fixed in 4.4.9 CWE-502

TI-2026-21881 CVE-2026-27474 · GHSA-c33v-v6jp-566m

SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)

LOW 22

SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00292 Published 2026-02-19 Fixed in 4.4.9 CWE-79

TI-2026-21880 CVE-2026-27473 · GHSA-fgj6-7f58-836m

SPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated Sites

LOW 23

SPIP before 4.4.9 allows Stored Cross-Site Scripting (XSS) via syndicated sites in the private area.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00302 Published 2026-02-19 Fixed in 4.4.9 CWE-79

TI-2026-21879 CVE-2026-27472 · GHSA-jg7m-pjj3-mqmq

SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites

LOW 24

SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00307 Published 2026-02-19 Fixed in 4.4.9 CWE-918

Vulnerabilities

Filters

SPIP < 4.4.9 Insecure Deserialization

SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)

SPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated Sites

SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites