CVE-2025-71241

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by the 'transmettre' API is not properly sanitized, allowing an attacker to inject malicious scripts. This vulnerability is mitigated by the SPIP security screen.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 19, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-712426.5SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check au CVE-2025-712439.8The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulner CVE-2025-712446.1SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, w CVE-2025-71257.2A vulnerability classified as critical was found in itsourcecode Employee Management System up to 1.0. Affected by this vulnerability is an CVE-2025-712517.5In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional ex CVE-2025-712527.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712537.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712547.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712557.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712567.5In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privile CVE-2025-712579.1BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of sec CVE-2025-712587.1BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API co