CVE-2023-24258: Spip

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter. This vulnerability allows attackers to execute arbitrary code via a crafted POST request.

Affected products

• Spip Spip: up to and including 4.1.5

Published 2023-02-27. Last modified 2026-06-17.