CVE-2025-71247

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-71247
CVSS

No CVSS.

R

ejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

References

No reference.

Configurations

No configuration.

History

19 Feb 2026, 19:22

Type Values Removed Values Added
Summary (en) SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area. When editing a syndicated site, the application does not verify that the syndication URL is a valid remote URL, allowing an authenticated attacker to make the server issue requests to arbitrary internal or external destinations. This vulnerability is not mitigated by the SPIP security screen. (en) Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVSS v2 : unknown
v3 : 4.3 		v2 : unknown
v3 : unknown
CWE CWE-918
References
  • {'url': 'https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html', 'source': '[email protected]'}
  • {'url': 'https://git.spip.net/spip/spip', 'source': '[email protected]'}
  • {'url': 'https://www.vulncheck.com/advisories/spip-blind-server-side-request-forgery-via-syndicated-sites', 'source': '[email protected]'}

19 Feb 2026, 16:27

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-19 16:27

Updated : 2026-02-19 19:22

NVD link : CVE-2025-71247

Mitre link : CVE-2025-71247

CVE.ORG link : CVE-2025-71247

JSON object : View

Products Affected

No product.

CWE

No CWE.