Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/trachinus/cve-2026-27472-and-cve-2026-27474
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubtrachinus/cve-2026-27472-and-cve-2026-27474

CVE-2026-27472-and-CVE-2026-27474

Proof-of-concept for CVE-2026-27472 (blind SSRF) and CVE-2026-27474 (stored XSS) in SPIP 4.4.8 syndication feature, demonstrating exploitation steps for administrators.

View Repository
7h 31m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-27472 and CVE-2026-27474 (CVSS-B 5.3 MEDIUM and CVSS-B 4.8 MEDIUM)

Blind SSRF in SPIP 4.4.8 Syndication Feature and stored XSS

> Explanations and more on my website <

PoC

  1. Log in as an administrator.

  2. Make sure that in the Site content configuration, Sites referencing and syndication is on Manage website directory.

  3. Navigate to a section and click Reference a site.

  4. In the Syndication field, click Syndication and enter a target IP and port: .

tcp://127.0.0.1:22

  • Save.

  • Compare the response time against a an open port (tcp://127.0.0.1:80). You can also click on Update now on the page of the syndicated site to trigger the SSRF.

    • In order to trigger an XSS, input javascript:alert(1) instead of the target IP and click on the RSS icon on the syndicated site page (?exec=site&id_syndic=1).

    Download Tool