Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV**), which disables SPIP output filtering. As a result, an unauthenticated attacker can inject crafted content that is evaluated through SPIP's template processing chain, leading to execution of code in the context of the web server.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-25 | 3 | Disclosure3 |
| 2026-03-02 | 1 | Disclosure1 |
CVE-2026-27744 UnauthRemoteentRemote Code Execution in in SPIp Tickets Plugin Plugin Before 4.3.3ion 3.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27744
Post summary
A new unauthenticated remote code execution vulnerability (CVE-2026-27744) has been identified in the SPIp Tickets Plugin versions before 4.3.3 and 3.3.
CVE-2026-27744 (CVSS:9.3, CRITICAL) is Analyzed. The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the fo..https://nvd.nist.gov/vuln/detail/CVE-2026-27744 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2026-27744, a critical unauthenticated RCE in SPIP tickets plugin versions prior to 4.3.3, providing basic vulnerability details but no PoC, exploit, or patch information.
🔴 CVE-2026-27744 - Critical The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends u... https://www.thehackerwire.com/vulnerability/CVE-2026-27744/ https://t.co/xFhjk1z0CR
Post summary
The post announces a critical unauthenticated RCE in SPIP tickets plugin versions before 4.3.3, providing technical details but no PoC, exploit code, or patch information.
CVE-2026-27744 The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. … https://www.cve.org/CVERecord?id=CVE-2026-27744
Post summary
The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | spip | tickets | - | - | - |