CVE-2026-27746

Katalog CVE

CVSS 6.1 · Medium EPSS 0,37%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada spip jeux. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the pre_propre pipeline. The plugin incorporates untrusted request parameters into HTML output without proper output encoding, allowing attackers to inject arbitrary script content into pages that render a jeux block. When a victim is induced to visit a crafted URL, the injected content is reflected into the response and executed in the victim's browser context.

Rincian

Terbit di NVD

25 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.spip.net/spip-contrib-extensions/jeux/-/commit/3d240cffb258491acd72f8b37579e8a7417740ff patch
• https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/ advisory pihak ketiga
• https://www.vulncheck.com/advisories/spip-jeux-reflected-xss-via-index-parameters advisory pihak ketiga
• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html release notes
• https://plugins.spip.net/jeux product