SPIP Vulnerabilities and Affected Products
Vulnerabilities associated with interface_traduction_objets.
Products
Clear product- SPIP24 vulnerabilities
- interface_traduction_objets2 vulnerabilities
- jeux1 vulnerability
- porte_plume plugin1 vulnerability
- referer_spam1 vulnerability
- saisies1 vulnerability
- Saisies pour formulaire1 vulnerability
- tickets1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-27745HIGH | SPIP interface_traduction_objets < 2.2.2 Authenticated RCEThe SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated remote code execution vulnerability in the translation interface workflow. The plugin incorporates untrusted request data into a hidden form field that is rendered without SPIP output filtering. Because fields prefixed with an underscore bypass protection mechanisms and the hidden content is rendered with filtering disabled, an authenticated attacker with editor-level privileges can inject crafted conten… CWE-94Feb 25, 2026 | CVSS8.7v4.0 | EPSS0.761% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-27747HIGH | SPIP interface_traduction_objets < 2.2.2 Authenticated SQL InjectionThe SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated SQL injection vulnerability in interface_traduction_objets_pipelines.php. When handling translation requests, the plugin reads the id_parent parameter from user-supplied input and concatenates it directly into a SQL WHERE clause in a call to sql_getfetsel() without input validation or parameterization. An authenticated attacker with editor-level privileges can inject crafted SQL expressions into the id_p… CWE-89Feb 25, 2026 | CVSS7.1v4.0 | EPSS0.378% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |