GCVE - cpe:2.3:a:spip:spip:3.1.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:spip:spip:3.1.0:*:*:*:*:*:*:*

part: a version: 3.1.0 update: *

Vendor	Spip (`07f60ada-7acf-5eb6-a7f1-b34680eac704`)
Product	Spip (`f4205da0-8b50-5b7e-bb5d-d003199a6313`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-9736`	vulnerable	2026-06-08 05:10:10.398196	Details available SPIP 3.1.x before 3.1.6 and 3.2.x before Beta 3 does not remove shell metacharacters from the host field, allowing a remote attacker to cause remote code execution. Published: 2017-06-17T16:00:00.000Z Updated: 2024-08-05T17:18:01.323Z Open on db.gcve.eu Reference links http://www.debian.org/security/2017/dsa-3890 https://core.spip.net/projects/spip/repository/revisions/23593 https://contrib.spip.net/CRITICAL-security-update-SPIP-3-1-6-and-SPIP-3-2-Beta https://core.spip.net/projects/spip/repository/revisions/23594	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9998`	vulnerable	2026-06-08 05:08:25.222200	Details available SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/info_plugin.php involving the `$plugin` parameter, as demonstrated by a /ecrire/?exec=info_plugin URL. Published: 2016-12-17T03:34:00.000Z Updated: 2024-08-06T03:07:32.094Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/95008 https://core.spip.net/projects/spip/repository/revisions/23288 http://www.securitytracker.com/id/1037486	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9997`	vulnerable	2026-06-08 05:08:25.218107	Details available SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/puce_statut.php involving the `$id` parameter, as demonstrated by a /ecrire/?exec=puce_statut URL. Published: 2016-12-17T03:34:00.000Z Updated: 2024-08-06T03:07:31.791Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/95008 https://core.spip.net/projects/spip/repository/revisions/23288 http://www.securitytracker.com/id/1037486	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-3154`	vulnerable	2026-06-08 05:07:44.679057	Details available The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object. Published: 2016-04-08T14:00:00.000Z Updated: 2024-08-05T23:47:57.507Z Open on db.gcve.eu Reference links https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-1-SPIP-3-0-22-et-SPIP-2-1.html?lang=fr http://www.debian.org/security/2016/dsa-3518 https://core.spip.net/projects/spip/repository/revisions/22903	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-3153`	vulnerable	2026-06-08 05:07:44.670742	Details available SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function. Published: 2016-04-08T14:00:00.000Z Updated: 2024-08-05T23:47:57.383Z Open on db.gcve.eu Reference links https://core.spip.net/projects/spip/repository/revisions/22911 https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-1-SPIP-3-0-22-et-SPIP-2-1.html?lang=fr http://www.debian.org/security/2016/dsa-3518	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.