Show filters
55 Total Results
Displaying 31-40 of 55
Sort by:
Attacker Value
Unknown
CVE-2016-7982
Disclosure Date: January 18, 2017 (last updated November 25, 2024)
Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the var_url parameter in a valider_xml action.
0
Attacker Value
Unknown
CVE-2016-9998
Disclosure Date: December 17, 2016 (last updated November 25, 2024)
SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/info_plugin.php involving the `$plugin` parameter, as demonstrated by a /ecrire/?exec=info_plugin URL.
0
Attacker Value
Unknown
CVE-2016-9997
Disclosure Date: December 17, 2016 (last updated November 25, 2024)
SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/puce_statut.php involving the `$id` parameter, as demonstrated by a /ecrire/?exec=puce_statut URL.
0
Attacker Value
Unknown
CVE-2016-9152
Disclosure Date: December 05, 2016 (last updated November 25, 2024)
Cross-site scripting (XSS) vulnerability in ecrire/exec/plonger.php in SPIP 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the rac parameter.
0
Attacker Value
Unknown
CVE-2016-3153
Disclosure Date: April 08, 2016 (last updated November 25, 2024)
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
0
Attacker Value
Unknown
CVE-2016-3154
Disclosure Date: April 08, 2016 (last updated November 25, 2024)
The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.
0
Attacker Value
Unknown
CVE-2013-7303
Disclosure Date: January 30, 2014 (last updated October 05, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in (1) squelettes-dist/formulaires/inscription.php and (2) prive/forms/editer_auteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field.
0
Attacker Value
Unknown
CVE-2013-4555
Disclosure Date: November 18, 2013 (last updated October 05, 2023)
Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors.
0
Attacker Value
Unknown
CVE-2013-4556
Disclosure Date: November 18, 2013 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the author page (prive/formulaires/editer_auteur.php) in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote attackers to inject arbitrary web script or HTML via the url_site parameter.
0
Attacker Value
Unknown
CVE-2013-4557
Disclosure Date: November 18, 2013 (last updated October 05, 2023)
The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter.
0
