# CVE-2025-71243: Saisies pour formulaire - RCE

> Live exploitation tracking for CVE-2025-71243 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-71243

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** SPIP Saisies pour formulaire
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** cms

## Description

The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately update to version 5.11.1 or later.

## CrowdSec analysis

[CVE-2025-71243](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-71243) is a critical remote code execution vulnerability in the 'Saisies pour formulaire' plugin for SPIP versions 5.4.0 through 5.11.0. This flaw allows unauthenticated attackers to execute arbitrary code on the affected server, potentially leading to full system compromise. Immediate updates to version 5.11.1 or later are strongly recommended to mitigate the risk of exploitation.

CrowdSec has been tracking this vulnerability and its exploits since 8th of April 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-71243 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the SPIP Saisies plugin by sending specially crafted requests to the `/spip.php?page=contact` endpoint, injecting malicious PHP code via the `_anciennes_valeurs` parameter to achieve remote code execution. This attack does not require authentication and targets publicly accessible SPIP installations running vulnerable plugin versions.

## Timeline

- 2026-02-19: CVE Published. CVE-2025-71243 is published to NVD.
- 2026-04-08: Rule Released. CrowdSec releases a rule to detect CVE-2025-71243 exploitation attempts against the CrowdSec Network.
- 2026-04-09: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-71243 for the first time.

## References

- https://plugins.spip.net/saisies
- https://www.vulncheck.com/advisories/spip-saisies-plugin-remote-code-execution
- https://blog.spip.net/Mise-a-jour-critique-de-securite-pour-le-plugin-Saisies.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71243.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-71243) follows observed exploitation activity for CVE-2025-71243. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.