SPIP Plugins SQLi/RCE/XSS Vulnerabilities (CVE-2026-27743/44/45/46/47)

Critical Vulnerability Information Vulnerability Overview CVEs: CVE-2026-27743, CVE-2026-27744, CVE-2026-27745, CVE-2026-27746, CVE-2026-27747 Affected Plugins: - referer_spam <= 1.2.1 - tickets <= 4.3.2 - interface_traduction_objets <= 2.2.1 - jeux <= 4.1.0 - interface_traduction_objets <= 2.2.1 Vulnerability Types: - SQL Injection - Remote Code Execution (RCE) - Cross-Site Scripting (XSS) Vulnerability Details CVE-2026-27743: SQL Injection in referer_spam Impact: Versions <= 1.2.1 Root Cause: User input ( ) is directly concatenated into SQL queries in two locations without using , , or . Exploitation Method: - Time-based blind injection (using to delay response time) - Character spoofing leading to server-side reflected XSS CVE-2026-27744: RCE in tickets Impact: Versions <= 4.3.2 Root Cause: The tickets plugin fails to validate and sanitize the form value when previewing comments, ultimately concatenating it into the template execution environment. Exploitation Method: - Submitting POST form data to execute remote commands CVE-2026-27745: Authenticated RCE in interface_traduction_objets Impact: Versions <= 2.2.1 Root Cause: Same template injection pattern as CVE-2025-71243, where user input is directly rendered and executed. Exploitation Method: - Breaking form value boundaries to inject PHP code CVE-2026-27747: SQL Injection in the Same Plugin Impact: Versions <= 2.2.1 Root Cause: Lack of proper sanitization of user input during SQL concatenation, leading to SQL injection. Exploitation Method: - Time-based blind injection CVE-2026-27746: XSS in jeux Impact: Versions <= 4.1.0 Root Cause: User input is not properly encoded and is concatenated directly into HTML. Exploitation Method: - Injection of reflected XSS Security Recommendations Update all affected plugins to their latest versions. Conduct independent audits and security testing for vulnerabilities when using any third-party plugins.

Goal Reached Thanks to every supporter — we hit 100%!

SPIP Plugins SQLi/RCE/XSS Vulnerabilities (CVE-2026-27743/44/45/46/47)