CVE-2013-4557
NoneCVSS
—
EPSS
25.3%
Published
Nov 18, 2013
CISA due date
—
The record
The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | spip | 0 | 2.1.24-1 |
| Debian:13 | spip | 0 | 2.1.24-1 |
| Debian:6.0 | spip | 0 | 2.1.1-3squeeze7 |
| Debian:7 | spip | 0 | 2.1.17-1+deb7u2 |
| Ubuntu:14.04:LTS | spip | 0 | 3.0.14-1 |
Related vulnerabilities
- CVE-2024-8517 SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. Also affects spip
- CVE-2024-7954 The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable… Also affects spip
- CVE-2017-15736 Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote… Also affects spip
- CVE-2016-7998 The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated… Also affects spip
- CVE-2016-7982 Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and… Also affects spip
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-94
- CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-94