CVE-2025-71246 in SPIP
Zusammenfassung
von MITRE • 19.02.2026
SPIP before 4.4.8 allows Cross-Site Scripting (XSS) in the public area for certain edge-case usage patterns. The echapper_html_suspect() function does not adequately detect all forms of malicious content, permitting an attacker to inject scripts that execute in a visitor's browser. This vulnerability is not mitigated by the SPIP security screen.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.