CVE-2025-71240

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SPIP before 4.2.15 allows Cross-Site Scripting (XSS) via crafted content in HTML code tags. The application does not properly verify JavaScript within code tags, allowing an attacker to inject malicious scripts that execute in a victim's browser.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-712416.1SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by t CVE-2025-712426.5SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check au CVE-2025-712439.8The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulner CVE-2025-712446.1SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, w CVE-2025-71257.2A vulnerability classified as critical was found in itsourcecode Employee Management System up to 1.0. Affected by this vulnerability is an CVE-2025-712517.5In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional ex CVE-2025-712527.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712537.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712547.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712557.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712567.5In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privile CVE-2025-712579.1BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of sec