Vulnerability Description
SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by the 'transmettre' API is not properly sanitized, allowing an attacker to inject malicious scripts. This vulnerability is mitigated by the SPIP security screen.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Spip | Spip | >= 4.1.0, < 4.1.20 |
Related Weaknesses (CWE)
References
- https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-3-6-SPIP-4-2-17-SRelease NotesVendor Advisory
- https://git.spip.net/spip/spipProduct
- https://www.vulncheck.com/advisories/spip-cross-site-scripting-in-private-areaThird Party Advisory
FAQ
What is CVE-2025-71241?
CVE-2025-71241 is a vulnerability with a CVSS score of 6.1 (MEDIUM). SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by the 'transmettre' API is not properly sanitized, allowing an ...
How severe is CVE-2025-71241?
CVE-2025-71241 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-71241?
Check the references section above for vendor advisories and patch information. Affected products include: Spip Spip.