Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: SPIP 4.4.18 Clear all filters
TI-2026-50946 CVE-2026-72710 · GHSA-g7qf-5m6v-m9vh

SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection

Priority HIGH 81

SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champs_editables allowlist by supplying an a…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01122 Published 2026-09-11 Fixed in 4.4.18 CWE-915
TI-2026-50945 CVE-2026-72709 · GHSA-px65-33x4-mwqq

SPIP < 4.4.18 Missing Authorization via ecrire/action/

Priority HIGH 81

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00658 Published 2026-09-11 Fixed in 4.4.18 CWE-862
TI-2026-50944 CVE-2026-72708 · GHSA-8c85-4pqf-wfwj

SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html

Priority HIGH 77

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matchi…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00518 Published 2026-09-11 Fixed in 4.4.18 CWE-89