CVE-2025-71243

9.3 criticalEPSS 5.6%

The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately update to version 5.11.1 or later.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 5.6% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2026-02-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

spip:saisies

References

https://blog.spip.net/Mise-a-jour-critique-de-securite-pour-le-plugin-Saisies.html
https://plugins.spip.net/saisies
https://www.vulncheck.com/advisories/spip-saisies-plugin-remote-code-execution

Check your stack JSON