CVE-2023-27372
CRITICAL 9.8EPSS 99.7%
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
- CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 99.68% chance of exploitation in the next 30 days, 100th percentile
- Nuclei
- critical
- Published
- 2023-02-28
- Updated
- 2025-03-11
Proof-of-concept exploits (17)
- 0SPwn/CVE-2023-27372-PoC6★ · 2023-07-05
- 1Ronkkeli/spip-cve-2023-27372-rce2★ · 2025-04-28
- 1amthebest1/CVE-2023-273720★ · 2024-08-15
- Chocapikk/CVE-2023-273728★ · 2023-09-16
- G01d3nW01f/cve-2023-273720★ · 2025-07-25
- Jhonsonwannaa/CVE-2023-273720★ · 2025-02-23
- Pari-Malam/CVE-2023-273723★ · 2023-07-31
- RSTG0D/CVE-2023-27372-PoC6★ · 2023-07-05
- ThatNotEasy/CVE-2023-273723★ · 2023-07-31
- dream434/CVE-2023-273720★ · 2025-02-23
- izzz0/CVE-2023-27372-POC2★ · 2023-07-12
- nuts7/CVE-2023-2737269★ · 2024-10-13
- redboltsec/CVE-2023-27372-PoC0★ · 2023-09-07
- Ap0dexMe0/CVE-2023-27372
- KirolosKhairy/CVE-2023-27372
- estebanzarate/CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC
- scriniariii/CVE-2023-27372