Loading story…
A critical unauthenticated remote code execution (RCE) flaw, tracked as CVE-2025-71243, was disclosed in the SPIP Saisies pour formulaire (Saisies) plugin affecting versions 5.4.0 through 5.11.0. The issue is categorized as CWE-94 (code injection) and allows an attacker to execute arbitrary code on the server; remediation is to upgrade to Saisies 5.11.1 or later. Technical analysis indicates exploitation is possible via PHP code injection through the _anciennes_valeurs form parameter, where attacker-controlled input is interpolated into a PHP template rendered with interdire_scripts=false, enabling <?php ... ?> execution server-side.
Separately, SPIP core also received a high-severity security fix for CVE-2025-71250, an insecure deserialization issue (CWE-502) in SPIP versions before 4.4.9 involving the table_valeur filter and the DATA iterator accepting serialized data. This deserialization weakness requires a precondition (the attacker must be able to place malicious serialized content via prior access or another vulnerability) and is noted as not mitigated by the SPIP security screen; the use of serialized data in these components is deprecated and planned for removal in SPIP 5. While both items affect the SPIP ecosystem, they are distinct vulnerabilities with different affected components, prerequisites, and fixes.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
A ProjectDiscovery Nuclei templates pull request added a template for CVE-2025-71243, describing the issue as an unauthenticated RCE in the SPIP Saisies plugin via PHP template injection. This made scanner-based detection content available for the flaw.
A Metasploit Framework pull request for a module targeting CVE-2025-71243 was updated via a force-push, rewriting the branch history from commit e3eb842 to 429c5ff. This indicates active weaponization and exploit module development for the vulnerability.
The CVE record for CVE-2025-71243 was received by disclosure@vulncheck.com, classifying the issue as CWE-94 and documenting network-exploitable unauthenticated RCE in the SPIP Saisies plugin. The entry included CVSS v3.1 and v4.0 scoring and references to the vendor notice and advisory.
A public write-up described CVE-2025-71243 as a PHP code injection issue via the `_anciennes_valeurs` parameter that can lead to server-side code execution during form rendering without authentication. The analysis also discussed exposure conditions, exploitation parallels to CVE-2023-27372, and mitigation guidance.
A critical unauthenticated remote code execution flaw affecting SPIP Saisies plugin versions 5.4.0 through 5.11.0 was addressed in version 5.11.1. SPIP's security notice advised users to update to the fixed release or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcecvefeed.io
Open sourcechocapikk.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SPIP issued back-to-back critical security updates after disclosing a **pre-authentication remote code execution** flaw that can be exploited against public-facing sites through the `X-Spip-Filtre` HTTP header. The project first released **SPIP 4.4.20** to address a universally exploitable issue affecting all versions, then followed with **SPIP 4.4.21** after determining that version `4.4.20` itself remained vulnerable. SPIP said the bug was reported anonymously via **ANSSI**, warned that exploitation attempts had already been observed in the wild, and stressed that the platform’s security screen does **not** mitigate the issue. The vulnerability is tracked as **`CVE-2026-77806`** and affects SPIP versions before `4.4.21`, with a CVSS 3.1 score reflecting critical impact (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`). Rapid7 also added a Metasploit module for related exploitation of the `X-Spip-Filtre` mechanism, describing unauthenticated code execution via function-call injection in SPIP’s template engine and command execution through a crafted POST request. Administrators were urged to update immediately to **SPIP 4.4.21**, with SPIP recommending upgrades via **`spip_loader` 7.0.0**.
Aug 28, 2026
SPIP released **version 4.4.18** as a critical security update to remediate multiple vulnerabilities affecting the CMS, including an **unauthenticated SQL injection**, unauthorized access to the `editer_objet` API, unauthorized author account modification, **remote code execution** through `spip_jobs` after SQL injection, code injection in the private area, and **SSRF** via redirection during remote content retrieval. SPIP said these issues are **not mitigated by the SPIP security screen** and added hardening measures such as job signing, stricter authorization checks for sensitive account fields, path traversal protections in `find_in_path()`, improved URL validation, and tighter restrictions on forum comment models. A separate high-severity flaw, tracked as **`CVE-2026-66738`**, affects SPIP versions prior to **4.4.18** when deployed with **SQLite**. The bug in the `/ecrire/?exec=navigation` endpoint lets an authenticated user with editor-level access supply crafted array input that bypasses sanitization, escapes an internally quoted PHP string during evaluation, and can result in arbitrary OS command execution; **MySQL-backed installations are not affected**. SPIP said administrators upgrading without `spip_loader` must complete a database update through the private area.
Aug 10, 2026
A newly recorded vulnerability, **CVE-2026-32968**, affects the `com_mb24sysapi` module and allows **unauthenticated remote code execution** through an OS command injection flaw. The weakness is classified as **CWE-78** and stems from improper neutralization of special elements in OS commands, enabling a remote attacker to execute arbitrary commands and potentially take full control of an affected system. The CVE is described as a variant of `CVE-2020-10383`, carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, and is referenced by CERT VDE advisories **VDE-2026-024** and **VDE-2026-025**. A separate high-severity issue, **CVE-2026-29839**, was recorded for **DedeCMS v5.7.118** in the `/sys_task_add.php` component. The flaw is a **Cross-Site Request Forgery** vulnerability classified as **CWE-352**, and its updated **CVSS v3.1** vector is `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, indicating that successful exploitation could significantly affect confidentiality, integrity, and availability. The record includes references to a public gist and the DedeCMS website, highlighting another internet-exposed web application weakness with potentially serious impact.
Jun 29, 2026