GCVE - cpe:2.3:a:spip:spip:3.1.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:spip:spip:3.1.3:*:*:*:*:*:*:*

part: a version: 3.1.3 update: *

Vendor	Spip (`07f60ada-7acf-5eb6-a7f1-b34680eac704`)
Product	Spip (`f4205da0-8b50-5b7e-bb5d-d003199a6313`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/spip`	purl2cpe	2026-06-01 10:16:58.256432
`pkg:deb/ubuntu/spip`	purl2cpe	2026-06-01 10:16:58.256434
`pkg:github/spip/spip`	purl2cpe	2026-06-01 10:16:58.256435

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-9736`	vulnerable	2026-06-08 05:10:10.402826	Details available SPIP 3.1.x before 3.1.6 and 3.2.x before Beta 3 does not remove shell metacharacters from the host field, allowing a remote attacker to cause remote code execution. Published: 2017-06-17T16:00:00.000Z Updated: 2024-08-05T17:18:01.323Z Open on db.gcve.eu Reference links http://www.debian.org/security/2017/dsa-3890 https://core.spip.net/projects/spip/repository/revisions/23593 https://contrib.spip.net/CRITICAL-security-update-SPIP-3-1-6-and-SPIP-3-2-Beta https://core.spip.net/projects/spip/repository/revisions/23594	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9998`	vulnerable	2026-06-08 05:08:25.222458	Details available SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/info_plugin.php involving the `$plugin` parameter, as demonstrated by a /ecrire/?exec=info_plugin URL. Published: 2016-12-17T03:34:00.000Z Updated: 2024-08-06T03:07:32.094Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/95008 https://core.spip.net/projects/spip/repository/revisions/23288 http://www.securitytracker.com/id/1037486	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9997`	vulnerable	2026-06-08 05:08:25.221733	Details available SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/puce_statut.php involving the `$id` parameter, as demonstrated by a /ecrire/?exec=puce_statut URL. Published: 2016-12-17T03:34:00.000Z Updated: 2024-08-06T03:07:31.791Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/95008 https://core.spip.net/projects/spip/repository/revisions/23288 http://www.securitytracker.com/id/1037486	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9152`	vulnerable	2026-06-08 05:08:22.788573	Details available Cross-site scripting (XSS) vulnerability in ecrire/exec/plonger.php in SPIP 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the rac parameter. Published: 2016-12-05T18:00:00.000Z Updated: 2024-08-06T02:42:11.120Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/94658 http://www.securitytracker.com/id/1037392 https://core.spip.net/projects/spip/repository/revisions/23290	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.