Unscored DLA-1975-1 4 CVEs

spip - security update

Published Oct 28, 2019 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 8	spip	3.0.17-2+deb8u5

Vulnerabilities 4

Unscored —

CVE-2019-16391

SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other…

spip spip Debian Ubuntu

Sep 17, 2019
Unscored —

CVE-2019-16392

SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.

spip spip Debian Ubuntu

Sep 17, 2019
Unscored —

CVE-2019-16393

SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 char…

spip spip Debian Ubuntu

Sep 17, 2019
Unscored —

CVE-2019-16394 Public exploit

SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on …

spip spip Debian Ubuntu

Sep 17, 2019