# cve.now: Spip

The newest entries naming Spip as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-122032](https://cve.now/CVE-2026-122032.md): SPIP before 4.4.29 Authenticated SQL Injection via where Parameter (CVSS 7.1)
- [CVE-2026-109378](https://cve.now/CVE-2026-109378.md): SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer\_url (CVSS 5.3)
- [CVE-2026-104070](https://cve.now/CVE-2026-104070.md): SPIP Crayons Plugin \< 3.5.0 Authorization Bypass RCE (CVSS 9.3)
- [CVE-2026-72710](https://cve.now/CVE-2026-72710.md): SPIP \< 4.4.18 RCE via editer\_objet.php Job Queue Injection (CVSS 9.3)
- [CVE-2026-72709](https://cve.now/CVE-2026-72709.md): SPIP \< 4.4.18 Missing Authorization via ecrire/action/ (CVSS 9.3)
- [CVE-2026-72708](https://cve.now/CVE-2026-72708.md): SPIP \< 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html (CVSS 8.7)
- [CVE-2026-77806](https://cve.now/CVE-2026-77806.md): SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. (CVSS 9.8)
- [CVE-2026-77647](https://cve.now/CVE-2026-77647.md): SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. (CVSS 9.8)
- [CVE-2026-66738](https://cve.now/CVE-2026-66738.md): SPIP \< 4.4.18 Code Injection via Navigation Endpoint on SQLite (CVSS 7.7)
- [CVE-2026-48832](https://cve.now/CVE-2026-48832.md): action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability. (CVSS 3.5)
- [CVE-2026-8430](https://cve.now/CVE-2026-8430.md): SPIP \< 4.4.14 Remote Code Execution via nginx (CVSS 8.1)
- [CVE-2026-8429](https://cve.now/CVE-2026-8429.md): SPIP \< 4.4.14 Remote Code Execution via Private Space (CVSS 8.8)
- [CVE-2026-33549](https://cve.now/CVE-2026-33549.md): SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an autho (CVSS 6.7)
- [CVE-2026-22205](https://cve.now/CVE-2026-22205.md): SPIP \< 4.4.10 Authentication Bypass via PHP Type Juggling (CVSS 8.7)
- [CVE-2026-22206](https://cve.now/CVE-2026-22206.md): SPIP \< 4.4.10 SQL Injection RCE via Union & PHP Tags (CVSS 8.7)
- [CVE-2026-27743](https://cve.now/CVE-2026-27743.md): SPIP referer\_spam \< 1.3.0 Unauthenticated SQL Injection (CVSS 9.3)
- [CVE-2026-27744](https://cve.now/CVE-2026-27744.md): SPIP tickets \< 4.3.3 Unauthenticated RCE (CVSS 9.3)
- [CVE-2026-27745](https://cve.now/CVE-2026-27745.md): SPIP interface\_traduction\_objets \< 2.2.2 Authenticated RCE (CVSS 8.7)
- [CVE-2026-27746](https://cve.now/CVE-2026-27746.md): SPIP jeux \< 4.1.1 Reflected XSS via index Parameters (CVSS 5.1)
- [CVE-2026-27747](https://cve.now/CVE-2026-27747.md): SPIP interface\_traduction\_objets \< 2.2.2 Authenticated SQL Injection (CVSS 7.1)
- [CVE-2026-27475](https://cve.now/CVE-2026-27475.md): SPIP \< 4.4.9 Insecure Deserialization (CVSS 9.2)
- [CVE-2026-27474](https://cve.now/CVE-2026-27474.md): SPIP \< 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix) (CVSS 4.8)
- [CVE-2026-27473](https://cve.now/CVE-2026-27473.md): SPIP \< 4.4.9 Stored Cross-Site Scripting via Syndicated Sites (CVSS 5.1)
- [CVE-2026-27472](https://cve.now/CVE-2026-27472.md): SPIP \< 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites (CVSS 5.3)
- [CVE-2026-26223](https://cve.now/CVE-2026-26223.md): SPIP \< 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area (CVSS 5.1)
- [CVE-2026-26345](https://cve.now/CVE-2026-26345.md): SPIP \< 4.4.8 Cross-Site Scripting in Public Area (CVSS 8.6)
- [CVE-2025-71244](https://cve.now/CVE-2025-71244.md): SPIP \< 4.4.5 Open Redirect via Login Form (CVSS 5.1)
- [CVE-2025-71243](https://cve.now/CVE-2025-71243.md): SPIP Saisies Plugin \< 5.11.1 Remote Code Execution (CVSS 9.3)
- [CVE-2025-71242](https://cve.now/CVE-2025-71242.md): SPIP \< 4.3.6 Authorization Bypass Leading to Content Disclosure (CVSS 5.3)
- [CVE-2025-71241](https://cve.now/CVE-2025-71241.md): SPIP \< 4.3.6 Cross-Site Scripting in Private Area (CVSS 4.8)
- [CVE-2025-71240](https://cve.now/CVE-2025-71240.md): SPIP \< 4.2.15 Cross-Site Scripting via Code Tags (CVSS 4.8)
- [CVE-2023-53900](https://cve.now/CVE-2023-53900.md): Spip 4.1.10 Admin Account Spoofing via Malicious SVG Upload (CVSS 4.8)
- [CVE-2024-8517](https://cve.now/CVE-2024-8517.md): SPIP Bigup Multipart File Upload OS Command Injection (CVSS 9.8)
- [CVE-2024-7954](https://cve.now/CVE-2024-7954.md): SPIP porte\_plume Plugin Arbitrary PHP Execution (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/spip
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.