Description
Multiple cross-site scripting (XSS) vulnerabilities in SPIP 1.9.x before 1.9.2.o, 2.0.x before 2.0.18, and 2.1.x before 2.1.13 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | spip | 2.1.13-1 | — |
| Debian 13 | spip | 2.1.13-1 | — |
| Debian 6.0 | spip | 2.1.1-3squeeze3 | DSA-2461-1 |
Advisories 1
- DSA-2461-1 spip - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- spip-unspecified-xss(75104) vdb-entry
- [oss-security] 20120501 Re: CVE request: spip before 1.9.2.o, 2.0.18 and 2.1.13 multiple XSS mailing-list
- 1026970 vdb-entry
- [Spip-en] 20120423 New stable releases SPIP 1.9.2o, 2.0.18 et 2.1.13 are availables mailing-list
- [oss-security] 20120430 CVE request: spip before 1.9.2.o, 2.0.18 and 2.1.13 multiple XSS mailing-list
- 48939 third-party-advisory
- 81473 vdb-entry
- 53216 vdb-entry
- DSA-2461 vendor-advisory