CVE-2026-27747

The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated SQL injection vulnerability in interface_traduction_objets_pipelines.php. When handling translation requests, the plugin reads the id_parent parameter from user-supplied input and concatenates it directly into a SQL WHERE clause in a call to sql_getfetsel() without input validation or parameterization. An authenticated attacker with editor-level privileges can inject crafted SQL expressions into the id_parent parameter to manipulate the backend query. Successful exploitation can result in disclosure or modification of database contents and may lead to denial of service depending on the database configuration and privileges.

• CWE-89

• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.htmlRelease Notes
• https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/Third Party Advisory
• https://git.spip.net/spip-contrib-extensions/interface_traduction_objets/-/commit/db3417b7811774f04c3ff191ca1737fe660ef0bePatch
• https://plugins.spip.net/interface_traduction_objetsProduct
• https://www.vulncheck.com/advisories/spip-interface-traduction-objets-authenticated-sql-injectionThird Party Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27741Bludit version 3.16.1 contains a cross-site request forgery …4.3
• CVE-2026-27742Bludit version 3.16.2 contains a stored cross-site scripting…5.4
• CVE-2026-27743The SPIP referer_spam plugin versions prior to 1.3.0 contain…9.8
• CVE-2026-27744The SPIP tickets plugin versions prior to 4.3.3 contain an u…9.8
• CVE-2026-27745The SPIP interface_traduction_objets plugin versions prior t…8.8
• CVE-2026-27746The SPIP jeux plugin versions prior to 4.1.1 contain a refle…6.1
• CVE-2026-27748Avira Internet Security contains an improper link resolution…7.1
• CVE-2026-27749Avira Internet Security contains a deserialization of untrus…7.8
• CVE-2026-2775Mitigation bypass in the DOM: HTML Parser component. This vu…9.8
• CVE-2026-27750Avira Internet Security contains a time-of-check time-of-use…7
• CVE-2026-27751SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 c…9.8
• CVE-2026-27752SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 t…8.2