{"vulnerability": "cve-2025-71243", "sightings": [{"uuid": "59c3ccad-6737-4d0e-8a9d-ee393d0e4b78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-71243", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mf7zhav6ty2t", "content": "", "creation_timestamp": "2026-02-19T16:32:41.364985Z"}, {"uuid": "ee5a3a60-0478-4a46-b1ac-91ef586b232e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-71243", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mf7zfeggqx2u", "content": "", "creation_timestamp": "2026-02-19T16:31:37.976735Z"}, {"uuid": "966170f3-6165-4f60-8c26-530955d062a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-71243", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spip_saisies_rce.rb", "content": "", "creation_timestamp": "2026-03-09T09:47:36.000000Z"}, {"uuid": "8760a068-ed1a-48fe-a32a-f8c3d9278726", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-71243", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mjaqdp3ncp2h", "content": "", "creation_timestamp": "2026-04-11T21:03:07.866737Z"}, {"uuid": "5f69e936-50f4-4b40-b6a7-674dbb31b89d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-71243", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spip_saisies_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"OpenStudio\", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated PHP code injection in the SPIP\\n          Saisies plugin (CVE-2025-71243). The _anciennes_valeurs form parameter is\\n          interpolated unsanitized into a hidden field rendered with\\n          interdire_scripts=false, allowing direct PHP code execution via template\\n          eval.\\n\\n          Exploitation requires a publicly accessible page containing a\\n          saisies-powered form, most commonly created with the Formidable plugin.\\n          Use the FORM_PAGE option to specify a known form page, or set it to\\n          'crawl' to automatically discover one by following internal links from\\n          the SPIP sitemap.\\n\\n          Versions 5.4.0 through 5.11.0 of the saisies plugin are affected.\", \"disclosure_date\": \"2025-02-19\", \"fullname\": \"exploit/multi/http/spip_saisies_rce\", \"is_install_path\": true, \"mod_time\": \"2026-03-05 14:13:05 +0000\", \"name\": \"SPIP Saisies Plugin Unauthenticated RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/spip_saisies_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/spip_saisies_rce\", \"references\": [\"CVE-2025-71243\", \"URL-https://blog.spip.net/Mise-a-jour-critique-de-securite-pour-le-plugin-Saisies.html\", \"URL-https://plugins.spip.net/saisies\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\", \"Windows Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:13.208165Z"}]}