Servers and applications
CVE-2016-3154 The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.
Severity Critical 9.8
Published 8 Apr 2016
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 1.8% in the next 30 daysHigher than 79% of CVEs. EPSS by FIRST , 11 Nov 2026
Attack Over the network · No login needed · No user action needed
Attacker can Read data · Change data · Take it down
CVSS vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources NVD Affected software Software Affected versions SPIPServers and applications · cpe:a:spip:spip Version 3.1.0 Version 3.0.20 Version 3.0.19 Version 3.0.17 All 62 release lines Version 2.0.0 Version 2.0.1 Version 2.0.2 Version 2.0.3 Version 2.0.4 Version 2.0.5 Version 2.0.6 Version 2.0.7 Version 2.0.8 Version 2.0.9 Version 2.0.10 Version 2.0.11 Version 2.0.12 Version 2.0.13 Version 2.0.14 Version 2.0.15 Version 2.0.16 Version 2.0.17 Version 2.0.18 Version 2.0.19 Version 2.0.20 Version 2.0.21 Version 2.0.22 Version 2.1.1 Version 2.1.2 Version 2.1.3 Version 2.1.4 Version 2.1.5 Version 2.1.6 Version 2.1.7 Version 2.1.8 Version 2.1.9 Version 2.1.10 Version 2.1.11 Version 2.1.12 Version 2.1.13 Version 2.1.14 Version 2.1.15 Version 2.1.16 Version 2.1.17 Version 2.1.18 Version 2.1.19 Version 3.0.0 Version 3.0.1 Version 3.0.2 Version 3.0.3 Version 3.0.4 Version 3.0.5 Version 3.0.6 Version 3.0.7 Version 3.0.8 Version 3.0.9 Version 3.0.10 Version 3.0.11 Version 3.0.13 Version 3.0.14 Version 3.0.15 Version 3.0.16 Version 3.0.17 Version 3.0.19 Version 3.0.20 Version 3.1.0
References NVD https://nvd.nist.gov/vuln/detail/CVE-2016-3154 CVE.org https://www.cve.org/CVERecord?id=CVE-2016-3154