Skip to content
OpenAdvisories

Product · SPIP

SPIP Crayons Plugin

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-104070

    SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE

    The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorizati…

    SPIP SPIP Crayons Plugin