VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Feb 19, 2026· Updated Jun 17, 2026

CVE-2025-71244

CVE-2025-71244

Description

SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a victim, redirects them to an arbitrary external site after login. This vulnerability only affects sites where the login page has been overridden to function in AJAX mode. It is not mitigated by the SPIP security screen.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Spip/Spip3 versions
    cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*range: >=4.3.0,<4.3.9
    • (no CPE)range: <4.4.5 and <4.3.9
    • (no CPE)range: 4.3.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.