Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-y4fe-ve98-pkgw
Vulnerability ID VCID-y4fe-ve98-pkgw
Aliases CVE-2021-44118
Summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') SPIP is affected by a Cross Site Scripting (XSS) vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users (stored XSS).
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2021-44118
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-44118
https://git.spip.net/spip/medias/commit/13c293fabd35e2c152379522c29432423936cbba
https://git.spip.net/spip/spip/commit/1cf91def15966406ddd0488cf9d1ecd1ae82d47a
https://git.spip.net/spip/spip/commit/4ccf90a6912d7fab97e1bd5619770c9236cc7357
CVE-2021-44118 https://nvd.nist.gov/vuln/detail/CVE-2021-44118
USN-5482-1 https://usn.ubuntu.com/5482-1/
USN-5482-2 https://usn.ubuntu.com/5482-2/
No exploits are available.
There are no known vectors.
Exploit Prediction Scoring System (EPSS)
Percentile 0.51442
EPSS Score 0.00278
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:56:45.459740+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/spip/spip/CVE-2021-44118.yml 38.6.0