What is the CVSS score of CVE-2025-71243?

CVE-2025-71243 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 73.5%.

Is there a public PoC exploit available for CVE-2025-71243?

Yes, a public proof-of-concept exploit is available for CVE-2025-71243. Prioritise patching immediately. EPSS: 73.5%.

How to fix or mitigate CVE-2025-71243?

Within 24 hours: Identify all systems running SPIP 5.4.0-5.11.0 with the Saisies plugin; disable or remove the vulnerable plugin immediately; implement network-level access controls to the affected application. Within 7 days: Conduct forensic analysis for signs of exploitation; review access logs and file modifications; deploy Web Application Firewall (WAF) rules to block known attack patterns; consider isolating affected systems from production networks if critical patch remains unavailable. Within 30 days: Monitor SPIP security advisories for patch availability; evaluate migration to patched versions or alternative solutions; implement enhanced monitoring for RCE indicators.

Saisies CVE-2025-71243

CRITICAL

Code Injection (CWE-94)

2026-02-19 disclosure@vulncheck.com

RCE Saisies Spip

9.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 9.8, EPSS 73.5%. SPIP is a popular CMS in French-speaking countries, used by government agencies, educational institutions, and media organizations. The Saisies plugin is one of the most commonly installed SPIP plugins. RCE on CMS servers exposes all content and user data.
Exploit ScenarioDerived	An attacker sends crafted form input to a SPIP site using the Saisies plugin. The payload is processed by the template engine, executing arbitrary PHP code. The attacker gains shell access, extracts the editorial database, and modifies published content.

Emergency Immediate action required. Why: CRITICAL + EPSS > 30%, no patch available.

No patch listed yet 73.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

The Saisies plugin for SPIP CMS versions 5.4.0 through 5.11.0 contains a critical remote code execution vulnerability. Attackers can exploit the vulnerability to execute arbitrary code on the SPIP server, compromising the content management system and its database.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:03 CVSS 9.8

Remote code execution in SPIP CMS Saisies plugin allows arbitrary code execution on the server.

RemediationAI

Update the Saisies plugin to version 5.11.1 or later immediately. If updating is not possible, disable or remove the plugin. Audit SPIP logs for suspicious form submissions. Verify the integrity of published content.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The Saisies (Forms) plugin for SPIP provides form building functionality for the CMS. Versions 5.4.0 through 5.11.0 contain a code injection flaw that allows attackers to execute arbitrary PHP code through crafted form inputs. SPIP's template compilation mechanism processes the injected code, executing it in the server context.

Know when Saisies gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately update to version 5.11.1 or later.

Executive ViewAI

Why It Matters

A critical Remote Code Execution vulnerability (CVE-2025-71243, CVSS 9.8) affects SPIP versions 5.4.0-5.11.0 in the Saisies plugin, allowing unauthenticated attackers to execute arbitrary code on affected servers. Organizations running these SPIP versions face immediate risk of complete system compromise, data breach, and operational disruption. With no patch currently available and a 73.5% exploit probability, this requires urgent mitigation action.

Business Impact: Severe

Compensating Controls

Disable or uninstall the Saisies plugin immediately; implement WAF rules to filter malicious requests targeting the Saisies plugin endpoints; restrict network access to SPIP administration interfaces using IP whitelisting; segment affected systems from critical infrastructure; enable detailed logging and real-time alerting for code execution attempts; consider isolating the application until a patch is available. Monitor SPIP vendor communications for patch release.

Threat Intelligence Overview

Threat Score

5.7/10

Composite threat intelligence

EPSS Score

73.5%

Top 1% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS POC (2)

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 73.5%

Patch available No

Active threat Yes

Deciding rule

CRITICAL + EPSS > 30%, no patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.