What is the CVSS score of CVE-2025-71243?

CVE-2025-71243 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 73.5%.

Which versions of Saisies are affected by CVE-2025-71243?

A critical Remote Code Execution vulnerability (CVE-2025-71243, CVSS 9.8) affects SPIP versions 5.4.0-5.11.0 in the Saisies plugin, allowing unauthenticated attackers to execute arbitrary code on…

Is there a public PoC exploit available for CVE-2025-71243?

Yes, a public proof-of-concept exploit is available for CVE-2025-71243. Prioritise patching immediately. EPSS: 73.5%.

How to fix or mitigate CVE-2025-71243?

Within 24 hours: Identify all systems running SPIP 5.4.0-5.11.0 with the Saisies plugin; disable or remove the vulnerable plugin immediately; implement network-level access controls to the affected application. Within 7 days: Conduct forensic analysis for signs of exploitation; review access logs and file modifications; deploy Web Application Firewall (WAF) rules to block known attack patterns; consider isolating affected systems from production networks if critical patch remains unavailable. Within 30 days: Monitor SPIP security advisories for patch availability; evaluate migration to patched versions or alternative solutions; implement enhanced monitoring for RCE indicators.

Saisies CVE-2025-71243

CRITICAL

Code Injection (CWE-94)

2026-02-19 disclosure@vulncheck.com

RCE Saisies

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 19, 2026 - 16:27 nvd

CRITICAL 9.8

DescriptionCVE.org

The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately update to version 5.11.1 or later.

AnalysisAI

The Saisies plugin for SPIP CMS versions 5.4.0 through 5.11.0 contains a critical remote code execution vulnerability. Attackers can exploit the vulnerability to execute arbitrary code on the SPIP server, compromising the content management system and its database.

Technical ContextAI

The Saisies (Forms) plugin for SPIP provides form building functionality for the CMS. Versions 5.4.0 through 5.11.0 contain a code injection flaw that allows attackers to execute arbitrary PHP code through crafted form inputs. SPIP's template compilation mechanism processes the injected code, executing it in the server context.

RemediationAI

Update the Saisies plugin to version 5.11.1 or later immediately. If updating is not possible, disable or remove the plugin. Audit SPIP logs for suspicious form submissions. Verify the integrity of published content.

CVE-2025-71243 vulnerability details – vuln.today

Back

Saisies CVE-2025-71243

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code