SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.
{ "binaries": [ { "binary_name": "spip", "binary_version": "3.0.21-1ubuntu1" } ] }
{ "binaries": [ { "binary_name": "spip", "binary_version": "3.1.4-4~deb9u3build0.18.04.1" } ], "availability": "No subscription required" }