PT-2026-20838 · Spip · Spip
CVE-2025-71240
·
Published
2025-01-01
·
Updated
2026-02-23
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
SPIP versions prior to 4.2.15
Description
The application does not properly validate JavaScript within HTML code tags, which allows for the injection of malicious scripts that execute in a victim’s browser. This can lead to Cross-Site Scripting (XSS).
Recommendations
Update to SPIP version 4.2.15 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Spip