CVE-2025-71243 is a critical Remote Code Execution (RCE) vulnerability affecting the 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0. This vulnerability allows an unauthenticated attacker to execute arbitrary code on the server with low attack complexity, resulting in complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating high awareness. Users are strongly advised to update to version 5.11.1 or later immediately to mitigate this severe risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.4.0, < 5.11.1CPE matchmatch criteria | cpe:2.3:a:spip:saisies:*:*:*:*:*:spip:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.