medium5.4
CVE-2025-71240
SPIP before 4.2.15 allows Cross-Site Scripting (XSS) via crafted content in HTML code tags.
Impact
SPIP before 4.2.15 allows Cross-Site Scripting (XSS) via crafted content in HTML code tags. The application does not properly verify JavaScript within code tags, allowing an attacker to inject malicious scripts that execute in a victim's browser.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Spip | Spip | from 4.2.0 before 4.2.15 |