Servers and applications
CVE-2016-3153 SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
Severity Critical 9.8
Published 8 Apr 2016
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 1.8% in the next 30 daysHigher than 79% of CVEs. EPSS by FIRST , 11 Nov 2026
Attack Over the network · No login needed · No user action needed
Attacker can Read data · Change data · Take it down
CVSS vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources NVD Affected software Software Affected versions SPIPServers and applications · cpe:a:spip:spip Version 3.1.0 Version 3.0.20 Version 3.0.19 Version 3.0.17 All 61 release lines Version 2.0.0 Version 2.0.1 Version 2.0.2 Version 2.0.3 Version 2.0.4 Version 2.0.5 Version 2.0.6 Version 2.0.7 Version 2.0.8 Version 2.0.9 Version 2.0.10 Version 2.0.11 Version 2.0.12 Version 2.0.13 Version 2.0.14 Version 2.0.15 Version 2.0.16 Version 2.0.17 Version 2.0.18 Version 2.0.19 Version 2.0.20 Version 2.0.21 Version 2.0.22 Version 2.1.1 Version 2.1.2 Version 2.1.3 Version 2.1.4 Version 2.1.5 Version 2.1.6 Version 2.1.7 Version 2.1.8 Version 2.1.9 Version 2.1.10 Version 2.1.11 Version 2.1.12 Version 2.1.13 Version 2.1.14 Version 2.1.15 Version 2.1.16 Version 2.1.17 Version 2.1.18 Version 3.0.0 Version 3.0.1 Version 3.0.2 Version 3.0.3 Version 3.0.4 Version 3.0.5 Version 3.0.6 Version 3.0.7 Version 3.0.8 Version 3.0.9 Version 3.0.10 Version 3.0.11 Version 3.0.13 Version 3.0.14 Version 3.0.15 Version 3.0.16 Version 3.0.17 Version 3.0.19 Version 3.0.20 Version 3.1.0
References NVD https://nvd.nist.gov/vuln/detail/CVE-2016-3153 CVE.org https://www.cve.org/CVERecord?id=CVE-2016-3153