Vendor
Remote Code Execution in SPIP SQLite Installations via CVE-2026-66738
1 rule 1 TTP 1 CVESPIP versions prior to 4.4.18 contain a code injection vulnerability in the navigation menu endpoint that allows authenticated editors to execute arbitrary OS commands on SQLite-backed installations.
Multiple Vulnerabilities in SPIP CMS Lead to Data Confidentiality Loss
3 TTPsMultiple vulnerabilities, including SQL injection and indirect remote code injection (XSS), were discovered in SPIP Content Management System versions prior to 4.4.16, allowing an attacker to compromise data confidentiality and execute malicious code in user browsers.
SPIP Security Policy Bypass Vulnerability
2 rules 1 TTPA vulnerability in SPIP versions prior to 4.4.15 allows an attacker to bypass the security policy, potentially leading to unauthorized actions.
SPIP RCE Vulnerability in Nginx Configurations (CVE-2026-8430)
2 rules 1 TTP 1 CVESPIP versions prior to 4.4.14 contain a remote code execution vulnerability exploitable in certain Nginx configurations, allowing attackers to execute arbitrary code within the web server's context.
CVE-2026-8429: SPIP Remote Code Execution Vulnerability
2 rules 1 TTP 1 CVESPIP versions prior to 4.4.14 contain a remote code execution vulnerability (CVE-2026-8429) in the private space, allowing attackers to execute arbitrary code in the context of the web server, bypassing SPIP security screen protections.