CVE-2021-44118

SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users (stored XSS).

• CWE-79

• https://git.spip.net/spip/medias/commit/13c293fabd35e2c152379522c29432423936cbbaPatch, Third Party Advisory
• https://git.spip.net/spip/spip/commit/1cf91def15966406ddd0488cf9d1ecd1ae82d47aPatch, Third Party Advisory
• https://git.spip.net/spip/spip/commit/4ccf90a6912d7fab97e1bd5619770c9236cc7357Patch, Third Party Advisory
• https://git.spip.net/spip/medias/commit/13c293fabd35e2c152379522c29432423936cbbaPatch, Third Party Advisory
• https://git.spip.net/spip/spip/commit/1cf91def15966406ddd0488cf9d1ecd1ae82d47aPatch, Third Party Advisory
• https://git.spip.net/spip/spip/commit/4ccf90a6912d7fab97e1bd5619770c9236cc7357Patch, Third Party Advisory

Published

Jan 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44109A buffer overflow in lib/sbi/message.c in Open5GS 2.3.6 and …7.5
• CVE-2021-4411The WP EasyPay – Square for WordPress plugin for WordPress i…4.3
• CVE-2021-44111A Directory Traversal vulnerability exists in S-Cart 6.7 via…4.4
• CVE-2021-44114Cross Site Scripting (XSS) vulnerability exists in Sourcecod…4.8
• CVE-2021-44116Cross Site Scripting (XSS) vulnerability exits in Anchor CMS…6.1
• CVE-2021-44117A Cross Site Request Forgery (CSRF) vulnerability exists in …8.8
• CVE-2021-4412The WP Prayer plugin for WordPress is vulnerable to Cross-Si…4.3
• CVE-2021-44120SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulne…5.4
• CVE-2021-44121Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-44122SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF…8.8
• CVE-2021-44123SPIP 4.0.0 is affected by a remote command execution vulnera…8.8
• CVE-2021-44124Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Direc…7.5