Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

SPIP — Vulnerabilities & Security Advisories 25

All 25 CVE vulnerabilities found in SPIP, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities for the SPIP content management system, a product developed by SPIP project maintainers, focusing on implementation weaknesses such as cross-site scripting, SQL injection, and authentication bypasses. It collects publicly disclosed security advisories and reports affecting SPIP, covering known issues from its initial releases through current versions. Readers can track the vendor's advisory history, understand the specific classes of flaws affecting this product, and review the chronological evolution of security patches to assess risk exposure. The data is presented to facilitate rapid identification of relevant weaknesses, enabling users to map known defects against their specific SPIP installation version.

Vendor: SPIP

CVE ID Title CVSS Severity Published
CVE-2026-72710 SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection CWE-915 9.8 Critical 2026-09-11
CVE-2026-72709 SPIP < 4.4.18 Missing Authorization via ecrire/action/ CWE-862 9.8 Critical 2026-09-11
CVE-2026-72708 SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html CWE-89 7.5 High 2026-09-11
CVE-2026-77806 SPIP 代码注入漏洞 CWE-94 9.8 Critical 2026-08-21
CVE-2026-77647 SPIP 代码注入漏洞 CWE-94 9.8 Critical 2026-08-20
CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite CWE-94 8.8 High 2026-08-10
CVE-2026-48832 SPIP 输入验证错误漏洞 CWE-601 3.5 Low 2026-05-24
CVE-2026-8430 SPIP < 4.4.14 Remote Code Execution via nginx CWE-94 8.1 High 2026-05-12
CVE-2026-8429 SPIP < 4.4.14 Remote Code Execution via Private Space CWE-94 8.8 High 2026-05-12
CVE-2026-33549 SPIP 安全漏洞 CWE-688 6.7 Medium 2026-03-22
CVE-2026-22205 SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling CWE-288 7.5 High 2026-02-26
CVE-2026-22206 SPIP < 4.4.10 SQL Injection RCE via Union & PHP Tags CWE-89 8.8 High 2026-02-26
CVE-2026-27475 SPIP < 4.4.9 Insecure Deserialization 8.1 High 2026-02-19
CVE-2026-27474 SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix) 6.1 Medium 2026-02-19
CVE-2026-27473 SPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated Sites 6.4 Medium 2026-02-19
CVE-2026-27472 SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites 4.3 Medium 2026-02-19
CVE-2026-26223 SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area 6.1 Medium 2026-02-19
CVE-2026-26345 SPIP < 4.4.8 Cross-Site Scripting in Public Area 5.4 Medium 2026-02-19
CVE-2025-71244 SPIP < 4.4.5 Open Redirect via Login Form CWE-601 6.1 Medium 2026-02-19
CVE-2025-71242 SPIP < 4.3.6 Authorization Bypass Leading to Content Disclosure 6.5 Medium 2026-02-19
CVE-2025-71241 SPIP < 4.3.6 Cross-Site Scripting in Private Area CWE-79 6.1 Medium 2026-02-19
CVE-2025-71240 SPIP < 4.2.15 Cross-Site Scripting via Code Tags CWE-79 5.4 Medium 2026-02-19
CVE-2023-53900 Spip 4.1.10 Admin Account Spoofing via Malicious SVG Upload CWE-79 8.8 High 2025-12-16
CVE-2024-8517 SPIP Bigup Multipart File Upload OS Command Injection CWE-73 9.8 Critical 2024-09-06
CVE-2024-7954 SPIP porte_plume Plugin Arbitrary PHP Execution CWE-95 9.8 Critical 2024-08-23

All 25 known CVE vulnerabilities affecting SPIP with full Chinese analysis, references, and POCs where available.