Skip to contentS9y Serendipity vulnerabilities
- s9y serendipitySerendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addressesCVE-2026-736298.4 High
- s9y serendipitySerendipity 2.3.5 Reflected XSS via search clean-URL routeCVE-2026-736285.3 Medium
- s9y serendipitySerendipity < 2.6.1 Open Redirect via exit.phpCVE-2026-673502.1 Low
- s9y serendipitySerendipity < 2.6.1 Authentication Bypass via Username CollisionCVE-2026-673518.7 High
- s9y serendipitySerendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOSTCVE-2026-39971Fix available7.2 High
- s9y serendipitySerendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domainCVE-2026-39963Fix available6.9 Medium
- s9y serendipitySerendipity 2.4.0 Authenticated Remote Code Execution via File UploadCVE-2023-539338.7 High
- s9y serendipitySerendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry CreationCVE-2023-539325.1 Medium
- s9y serendipitySerendipity 2.5.0 Remote Code Execution via Authenticated Media UploadCVE-2024-582828.6 High
- s9y serendipityAn arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute...CVE-2023-315768.8 High
- s9y serendipitySerendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the...CVE-2020-109649.8 Critical
- serendipity freetag plugin, s9y serendipity event freetag +1 moreA Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30...CVE-2011-36106.1 Medium
- s9y serendipitySerendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.CVE-2011-4090Public exploit6.1 Medium
- s9y serendipityCross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows...CVE-2011-11356.1 Medium
- s9y serendipityCross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows...CVE-2011-11349.8 Critical
- s9y serendipityCross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows...CVE-2011-11336.1 Medium
- s9y serendipityserendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute...CVE-2016-107529.8 Critical
- s9y serendipitySerendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin...CVE-2019-118706.1 Medium
- s9y serendipitySerendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.CVE-2016-107375.4 Medium
- s9y serendipitySerendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information...CVE-2017-10001297.5 High
- s9y serendipityStored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other...CVE-2017-81025.4 Medium
- s9y serendipityThere is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request.CVE-2017-81018.8 High
- s9y serendipitySQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows...CVE-2017-56098.8 High
- s9y serendipitySerendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin.CVE-2017-54768.8 High
- s9y serendipitycomment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments.CVE-2017-54758.8 High
- s9y serendipityOpen redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers...CVE-2017-54746.1 Medium
- s9y serendipityinclude/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion...CVE-2016-100829.8 Critical
- s9y serendipityMultiple cross-site scripting (XSS) vulnerabilities in Serendipity before 2.0.5 allow remote...CVE-2016-96815.4 Medium
- s9y serendipityIn Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP...CVE-2016-97528.6 High
- s9y serendipityCross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to...CVE-2015-86035.4 Medium
- s9y serendipityCross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity...CVE-2015-69694.3 Medium
- s9y serendipityMultiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include...CVE-2015-69686.5 Medium
- s9y serendipitySQL injection vulnerability in the serendipity_checkCommentToken function in include...CVE-2015-69436.0 Medium
- s9y serendipityCross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity...CVE-2015-22893.5 Low
- s9y serendipityMultiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in...CVE-2014-94324.3 Medium
- s9y serendipityCross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea...CVE-2013-56704.3 Medium
- s9y serendipityCross-site scripting (XSS) vulnerability in serendipity_admin_image_selector.php in Serendipity 1...CVE-2013-5314Public exploit4.3 Medium
- s9y serendipitySQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1...CVE-2012-2332Public exploit7.5 High
- s9y serendipityCross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in...CVE-2012-2331Public exploit4.3 Medium
- s9y serendipitySQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows...CVE-2012-27627.5 High
- s9y serendipitySerendipity 1.5.5 allows remote attackers to obtain sensitive information via a direct request to...CVE-2011-38005.0 Medium
- s9y serendipityCross-site scripting (XSS) vulnerability in Serendipity before 1.5.4, when "Remember me" logins...CVE-2010-29572.6 Low
- s9y serendipity, xinha wysiwyg editor +1 moreThe dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in...CVE-2010-19167.5 High
- s9y serendipityUnrestricted file upload vulnerability in Serendipity before 1.5 allows remote authenticated...CVE-2009-44126.0 Medium
- s9y serendipity event freetagSQL injection vulnerability in the Freetag (serendipity_event_freetag) plugin before 3.09 for...CVE-2009-33377.5 High
- s9y serendipityMultiple cross-site scripting (XSS) vulnerabilities in the installer in Serendipity (S9Y) 1.3...CVE-2008-13864.3 Medium
- s9y serendipityCross-site scripting (XSS) vulnerability in the Top Referrers (aka referrer) plugin in...CVE-2008-1385Public exploit4.3 Medium
- s9y serendipityCross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3-beta1 allows remote...CVE-2008-01244.3 Medium
- s9y serendipity event freetagCross-site scripting (XSS) vulnerability in the Freetag before 2.96 plugin for S9Y Serendipity,...CVE-2008-0751Public exploit4.3 Medium
- s9y serendipityCross-site scripting (XSS) vulnerability in the remote RSS sidebar plugin ...CVE-2007-62054.3 Medium
- Show olderLoading…