CVE-2025-71243

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately update to version 5.11.1 or later.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Feb 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-712446.1SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, w CVE-2025-71257.2A vulnerability classified as critical was found in itsourcecode Employee Management System up to 1.0. Affected by this vulnerability is an CVE-2025-712517.5In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional ex CVE-2025-712527.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712537.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712547.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712557.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712567.5In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privile CVE-2025-712579.1BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of sec CVE-2025-712587.1BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API co CVE-2025-712597.1BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS CVE-2025-71267.2A vulnerability, which was classified as critical, has been found in itsourcecode Employee Management System up to 1.0. Affected by this iss