CVE-2026-27747Disclosure(spip / interface_traduction_objets)

LOWCVSS 8.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated SQL injection vulnerability in interface_traduction_objets_pipelines.php. When handling translation requests, the plugin reads the id_parent parameter from user-supplied input and concatenates it directly into a SQL WHERE clause in a call to sql_getfetsel() without input validation or parameterization. An authenticated attacker with editor-level privileges can inject crafted SQL expressions into the id_parent parameter to manipulate the backend query. Successful exploitation can result in disclosure or modification of database contents and may lead to denial of service depending on the database configuration and privileges.

spip CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://git.spip.net/spip-contrib-extensions/interface_traduction_objets/-/commit/db3417b7811774f04c3ff191ca1737fe660ef0be

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

interface_traduction_objets

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Affected systems

Vendors

spip

Products

interface_traduction_objets

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Vulmon Vulnerability Feed@VulmonFeeds228d
Disclosure
CVE-2026-27747 Authenticated SQL Injection in SPIP interface_traduction_objets P... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27747 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
A new authenticated SQL injection vulnerability (CVE-2026-27747) in SPIP's interface_traduction_objets has been disclosed, with details available on Vulmon.
0001038
4.0K followersView on X
CVE@CVEnew228d
Disclosure
CVE-2026-27747 The SPIP interface_traduction_objets plugin versions prior to 4.3.3 contain an authenticated SQL injection vulnerability in interface_traduction_objets_pipelines.php.… https://www.cve.org/CVERecord?id=CVE-2026-27747
Post summary
The CVE-2026-27747 disclosure notes an authenticated SQL injection in the SPIP interface_traduction_objets plugin (pre‑4.3.3), with no PoC, exploit, or patch details provided.
00000105
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	spip	interface_traduction_objets	-	-	-

Explore more

Back to dashboard spip CVEs interface_traduction_objets vulnerabilities