Launchpad.net

CVE 2022-37155

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.

See the CVE page on Mitre.org for more details.