Alerte pour un CPE
Stay informed of any changes for a specific CPE.
CPE Name: cpe:2.3:a:spip:spip:3.1.14:*:*:*:*:*:*:*
Informations
Vendor
spipProduct
spipVersion
3.1.14Related CVE
| CVE ID | Published | Description | Score | Severity |
|---|---|---|---|---|
23h00 +00:00 |
SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js. | 6.1 |
Medium |
|
23h00 +00:00 |
ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics. | 6.1 |
Medium |
|
23h00 +00:00 |
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1. | 9.8 |
Critical |
|
23h00 +00:00 |
SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter. This vulnerability allows attackers to execute arbitrary code via a crafted POST request. | 9.8 |
Critical |
|
23h00 +00:00 |
RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter. | 8.8 |
High |
|
18h26 +00:00 |
A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire. | 8.8 |
High |
|
03h58 +00:00 |
SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code. | 8.8 |
High |
|
03h58 +00:00 |
SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects. | 5.3 |
Medium |
|
20h48 +00:00 |
prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters. | 9.8 |
Critical |
2025©
tesweb SA
