CVE-2025-71240

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-71240
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71240.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-71240
Downstream
Published
2026-02-19T14:58:12.961Z
Modified
2026-07-15T01:49:01.069961776Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
SPIP < 4.2.15 Cross-Site Scripting via Code Tags
Details

SPIP before 4.2.15 allows Cross-Site Scripting (XSS) via crafted content in HTML code tags. The application does not properly verify JavaScript within code tags, allowing an attacker to inject malicious scripts that execute in a victim's browser.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71240.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / git.spip.net/spip/spip

Affected ranges

Type
GIT
Repo
https://git.spip.net/spip/spip
Events
Introduced
ecac31e4c3c28ad0d7969b2f44c4e3b6711b0dfc
Fixed
4cbed5e45875e6b3cd60b3005a2dad0e8dcc6f9f
Database specific 
{
    "extracted_events": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.15"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*"
}

Affected versions

v4.*
v4.2.0
v4.2.1
v4.2.10
v4.2.11
v4.2.12
v4.2.13
v4.2.14
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.2.6
v4.2.7
v4.2.8
v4.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71240.json"