CVE-2016-7981

MEDIUM NUCLEI

SPIP < 3.1.2 - Cross-Site Scripting via var_url Parameter

Title source: llm

Exploitation Summary

CVE-2016-7981 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action.

Nuclei Templates (1)

SPIP <3.1.2 - Cross-Site Scripting

MEDIUMby pikpikcu

Shodan: http.html:"spip.php?page=backend" || cpe:"cpe:2.3:a:spip:spip"

FOFA: body="spip.php?page=backend"

References (7)

Core 7

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/93451

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/10/12/7

Issue Tracking, Patch, Vendor Advisory x_refsource_confirm

https://core.spip.net/projects/spip/repository/revisions/23200

Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/10/06/6

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/10/05/17

Issue Tracking, Patch, Vendor Advisory x_refsource_confirm

https://core.spip.net/projects/spip/repository/revisions/23202

Issue Tracking, Patch, Vendor Advisory x_refsource_confirm

https://core.spip.net/projects/spip/repository/revisions/23201

Scores

CVSS v3 6.1

EPSS 0.0822

EPSS Percentile 94.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

spip/spip < 3.1.2

Published Jan 18, 2017

Tracked Since Feb 18, 2026