Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by the 'transmettre' API is not properly sanitized, allowing an attacker to inject malicious scripts. This vulnerability is mitigated by the SPIP security screen.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2025-71241 Cross-Site Scripting in SPIP Private Area via Unsanitized Error Message https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-71241
Post summary
The post reports CVE‑2025‑71241 as a Cross‑Site Scripting flaw in SPIP’s private area caused by unsanitized error messages, but provides no evidence of exploitation, PoC, or remediation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | spip | spip | - | - | - |