CVE-2025-71244

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a victim, redirects them to an arbitrary external site after login. This vulnerability only affects sites where the login page has been overridden to function in AJAX mode. It is not mitigated by the SPIP security screen.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Feb 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-71257.2A vulnerability classified as critical was found in itsourcecode Employee Management System up to 1.0. Affected by this vulnerability is an CVE-2025-712517.5In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional ex CVE-2025-712527.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712537.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712547.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712557.5In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privil CVE-2025-712567.5In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privile CVE-2025-712579.1BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of sec CVE-2025-712587.1BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API co CVE-2025-712597.1BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS CVE-2025-71267.2A vulnerability, which was classified as critical, has been found in itsourcecode Employee Management System up to 1.0. Affected by this iss CVE-2025-712608.8BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet'