CVE-2025-71243

critical · 9.3

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately update to version 5.11.1 or later.

9.3

CVSS

5.1%

EPSS (exploit prob.)

92nd

EPSS percentile

2026-02-19

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
spip	saisies	>= 5.4.0, < 5.11.1

Check a specific version with /api/v1/cve/match.

References

https://blog.spip.net/Mise-a-jour-critique-de-securite-pour-le-plugin-Saisies.html
https://plugins.spip.net/saisies
https://www.vulncheck.com/advisories/spip-saisies-plugin-remote-code-execution

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-71243