Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

SPIP — Vulnerabilities & Security Advisories 20

All 20 CVE vulnerabilities found in SPIP, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for SPIP, a widely used open-source content management system, categorized by common weakness types and security tags. It collects reports of software flaws, including SQL injection, cross-site scripting, and unauthorized access issues, covering disclosed incidents from the early 2000s through recent years. Here, security professionals and administrators can track vendor advisories to stay informed about patch availability, understand the prevalence and impact of specific weakness classes within this ecosystem, and look up a product's vulnerability history to assess long-term security hygiene. The collection includes details on affected versions, severity scores where available, and resolution status, providing a comprehensive view of the threat landscape associated with SPIP installations. By centralizing this information, the resource aids in risk assessment, compliance auditing, and informed decision-making regarding system upgrades or mitigation strategies. Users can compare findings across different time periods to identify trends in reporting and remediation efficiency. This curated data serves as a reference point for evaluating the relative safety of the platform and integrating appropriate defensive measures into broader security operations. The information is organized to facilitate quick navigation and thorough analysis for both technical and managerial audiences interested in the specific security posture of this particular software solution.

Vendor: SPIP

CVE IDTitleCVSSSeverityPublished
CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite CWE-94 8.8 High2026-08-10
CVE-2026-48832 SPIP 输入验证错误漏洞 CWE-601 3.5 Low2026-05-24
CVE-2026-8430 SPIP < 4.4.14 Remote Code Execution via nginx CWE-94 8.1 High2026-05-12
CVE-2026-8429 SPIP < 4.4.14 Remote Code Execution via Private Space CWE-94 8.8 High2026-05-12
CVE-2026-33549 SPIP 安全漏洞 CWE-688 6.7 Medium2026-03-22
CVE-2026-22205 SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling CWE-288 7.5 High2026-02-26
CVE-2026-22206 SPIP < 4.4.10 SQL Injection RCE via Union & PHP Tags CWE-89 8.8 High2026-02-26
CVE-2026-27475 SPIP < 4.4.9 Insecure Deserialization 8.1 High2026-02-19
CVE-2026-27474 SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix) 6.1 Medium2026-02-19
CVE-2026-27473 SPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated Sites 6.4 Medium2026-02-19
CVE-2026-27472 SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites 4.3 Medium2026-02-19
CVE-2026-26223 SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area 6.1 Medium2026-02-19
CVE-2026-26345 SPIP < 4.4.8 Cross-Site Scripting in Public Area 5.4 Medium2026-02-19
CVE-2025-71244 SPIP < 4.4.5 Open Redirect via Login Form CWE-601 6.1 Medium2026-02-19
CVE-2025-71242 SPIP < 4.3.6 Authorization Bypass Leading to Content Disclosure 6.5 Medium2026-02-19
CVE-2025-71241 SPIP < 4.3.6 Cross-Site Scripting in Private Area CWE-79 6.1 Medium2026-02-19
CVE-2025-71240 SPIP < 4.2.15 Cross-Site Scripting via Code Tags CWE-79 5.4 Medium2026-02-19
CVE-2023-53900 Spip 4.1.10 Admin Account Spoofing via Malicious SVG Upload CWE-79 8.8 High2025-12-16
CVE-2024-8517 SPIP Bigup Multipart File Upload OS Command Injection CWE-73 9.8 Critical2024-09-06
CVE-2024-7954 SPIP porte_plume Plugin Arbitrary PHP Execution CWE-95 9.8 Critical2024-08-23

All 20 known CVE vulnerabilities affecting SPIP with full Chinese analysis, references, and POCs where available.