Spip

SQL injection in SPIP prior to 4.4.10 enables authenticated users with low privileges to execute arbitrary SQL commands and achieve remote code execution through union-based injection combined with PHP tag processing. The vulnerability affects SPIP and PHP environments, requiring only network access and valid credentials to exploit. No patch is currently available, presenting significant risk to production SPIP installations.

Spip versions up to 4.4.10 contains a vulnerability that allows attackers to access protected information (CVSS 7.5).

Arbitrary code execution in SPIP before 4.4.9 through insecure deserialization of untrusted serialized objects in the table_valeur filter and DATA iterator. An attacker with prior access or leveraging a separate vulnerability to inject malicious serialized data can trigger arbitrary object instantiation and achieve remote code execution. No patch is currently available, and the vulnerability persists despite SPIP's standard security protections.

Reflected XSS in SPIP versions before 4.4.9 permits attackers to execute arbitrary scripts in the private area through insufficiently sanitized input, form, button, and anchor HTML tags. An unauthenticated attacker can craft malicious payloads that bypass the incomplete anti-XSS protection introduced in version 4.4.8, affecting all SPIP installations without the patch.

Stored XSS in SPIP before 4.4.9 allows authenticated attackers to inject malicious scripts through syndicated site URLs that execute in the private administrative area when other admins view syndication details. An attacker with the ability to configure a malicious syndication feed can achieve persistent code execution affecting other administrators. No patch is currently available for this vulnerability.

SPIP versions prior to 4.4.9 contain a blind server-side request forgery vulnerability in the syndication feature that allows authenticated users to manipulate the application into making arbitrary network requests to internal or external systems. An attacker with valid credentials can exploit this by crafting malicious syndication URLs during site editing, bypassing the security filter mechanisms. No patch is currently available for this vulnerability.

Stored XSS in SPIP before 4.4.8 allows authenticated users with content-editing privileges to inject malicious scripts through inadequate sanitization in the echapper_html_suspect() function, which then execute in the browsers of other users including administrators. Attackers can exploit this vulnerability to perform unauthorized actions and modify application state within the security context of victim users. No patch is currently available.

Improper iframe sanitization in SPIP before 4.4.8 enables stored cross-site scripting attacks within the private administrative area, allowing attackers to execute arbitrary JavaScript in the context of backend users. An unauthenticated attacker can inject malicious iframe tags that bypass the application's security filters and execute in victims' browsers when they access the affected area. No patch is currently available and the built-in SPIP security screen does not mitigate this vulnerability.

Spip versions up to 4.4.5 is affected by url redirection to untrusted site (open redirect) (CVSS 6.1).

SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. [CVSS 6.5 MEDIUM]

SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by the 'transmettre' API is not properly sanitized, allowing an attacker to inject malicious scripts. [CVSS 6.1 MEDIUM]

SPIP before 4.2.15 allows Cross-Site Scripting (XSS) via crafted content in HTML code tags. The application does not properly verify JavaScript within code tags, allowing an attacker to inject malicious scripts that execute in a victim's browser. [CVSS 5.4 MEDIUM]