CVE-2026-73629 | High | 8.5 | 2026-08-13 | Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addr… |
CVE-2026-73628 | Medium | 6.1 | 2026-08-13 | Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/fu… |
CVE-2026-67350 | Medium | 4.3 | 2026-07-31 | Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external site… |
CVE-2026-67351 | High | 8.8 | 2026-07-30 | Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without… |
CVE-2026-39971 | High | 7.2 | 2026-04-15 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTT… |
CVE-2026-39963 | Medium | 6.9 | 2026-04-15 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_S… |
CVE-2023-53933 | High | 8.8 | 2025-12-17 | Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attack… |
CVE-2023-53932 | Medium | 5.4 | 2025-12-17 | Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through blog entry creation… |
CVE-2024-58282 | High | 7.2 | 2025-12-10 | Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media uploa… |
CVE-2023-31576 | High | 8.8 | 2023-05-16 | An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file. |
CVE-2020-10964 | Critical | 9.8 | 2020-03-25 | Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This file may… |
CVE-2011-3610 | Medium | 6.1 | 2020-01-22 | A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendipity_event_freetag/… |
CVE-2011-4090 | Medium | 6.1 | 2019-11-26 | Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation. |
CVE-2011-1135 | Medium | 6.1 | 2019-11-05 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/Extended… |
CVE-2011-1134 | Critical | 9.8 | 2019-11-05 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manage… |
CVE-2011-1133 | Medium | 6.1 | 2019-11-05 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/Extende… |
CVE-2016-10752 | Critical | 9.8 | 2019-05-24 | serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless fil… |
CVE-2019-11870 | Medium | 6.1 | 2019-05-09 | Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/adm… |
CVE-2016-10737 | Medium | 5.4 | 2019-01-16 | Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter. |
CVE-2017-1000129 | High | 7.5 | 2017-11-17 | Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure |
CVE-2017-8102 | Medium | 5.4 | 2017-04-24 | Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is rela… |
CVE-2017-8101 | High | 8.8 | 2017-04-24 | There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request. |
CVE-2017-5609 | High | 8.8 | 2017-01-28 | SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via t… |
CVE-2017-5476 | High | 8.8 | 2017-01-14 | Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin. |
CVE-2017-5475 | High | 8.8 | 2017-01-14 | comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments. |
CVE-2017-5474 | Medium | 6.1 | 2017-01-14 | Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing a… |
CVE-2016-10082 | Critical | 9.8 | 2016-12-30 | include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time insta… |
CVE-2016-9681 | Medium | 5.4 | 2016-12-25 | Multiple cross-site scripting (XSS) vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a c… |
CVE-2016-9752 | High | 8.6 | 2016-12-01 | In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status… |
CVE-2015-8603 | Medium | 5.4 | 2016-01-12 | Cross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the serendipity[entry_i… |
CVE-2015-6969 | | | 2015-09-16 | Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script… |
CVE-2015-6968 | | | 2015-09-16 | Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow re… |
CVE-2015-6943 | | | 2015-09-15 | SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens f… |
CVE-2015-2289 | | | 2015-03-23 | Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrar… |
CVE-2014-9432 | | | 2014-12-31 | Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arb… |
CVE-2013-5670 | | | 2013-11-05 | Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly oth… |
CVE-2013-5314 | | | 2013-08-19 | Cross-site scripting (XSS) vulnerability in serendipity_admin_image_selector.php in Serendipity 1.6.2 and earlier allows remote attackers to inject arbitrary w… |
CVE-2012-2332 | | | 2012-08-13 | SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the… |
CVE-2012-2331 | | | 2012-08-13 | Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1 allows remote attackers to inject arbi… |
CVE-2012-2762 | | | 2012-06-07 | SQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url… |
CVE-2011-3800 | | | 2011-09-24 | Serendipity 1.5.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error… |
CVE-2010-2957 | | | 2010-09-10 | Cross-site scripting (XSS) vulnerability in Serendipity before 1.5.4, when "Remember me" logins are enabled, allows remote attackers to inject arbitrary web sc… |
CVE-2010-1916 | | | 2010-05-12 | The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass… |
CVE-2009-4412 | | | 2009-12-24 | Unrestricted file upload vulnerability in Serendipity before 1.5 allows remote authenticated users to execute arbitrary code by uploading a file with an execut… |
CVE-2009-3337 | | | 2009-09-24 | SQL injection vulnerability in the Freetag (serendipity_event_freetag) plugin before 3.09 for Serendipity (S9Y) allows remote attackers to execute arbitrary SQ… |
CVE-2008-1386 | | | 2008-04-23 | Multiple cross-site scripting (XSS) vulnerabilities in the installer in Serendipity (S9Y) 1.3 allow remote attackers to inject arbitrary web script or HTML via… |
CVE-2008-1385 | | | 2008-04-23 | Cross-site scripting (XSS) vulnerability in the Top Referrers (aka referrer) plugin in Serendipity (S9Y) before 1.3.1 allows remote attackers to inject arbitra… |
CVE-2008-0124 | | | 2008-02-28 | Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via (1)… |
CVE-2008-0751 | | | 2008-02-13 | Cross-site scripting (XSS) vulnerability in the Freetag before 2.96 plugin for S9Y Serendipity, when using Internet Explorer 6 or 7, allows remote attackers to… |
CVE-2007-6205 | | | 2007-12-11 | Cross-site scripting (XSS) vulnerability in the remote RSS sidebar plugin (serendipity_plugin_remoterss) in S9Y Serendipity before 1.2.1 allows remote attacker… |
CVE-2006-6242 | | | 2006-12-03 | Multiple directory traversal vulnerabilities in Serendipity 1.0.3 and earlier allow remote attackers to read or include arbitrary local files via a .. (dot dot… |
CVE-2006-2495 | | | 2006-05-20 | Cross-site request forgery (CSRF) vulnerability in the Entry Manager in Serendipity before 1.0-beta3 allows remote attackers to perform unauthorized actions as… |
CVE-2006-1910 | | | 2006-04-20 | config.php in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values that are stored in config.php and later execute… |
CVE-2005-3129 | | | 2005-10-04 | Cross-site request forgery (CSRF) vulnerability in Serendipity 0.8.4 and earlier allows remote attackers to perform unauthorized actions as a logged in user vi… |
CVE-2005-1713 | | | 2005-05-24 | Multiple cross-site scripting (XSS) vulnerabilities in Serendipity 0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) templatedropdo… |
CVE-2005-1452 | | | 2005-05-03 | Serendipity before 0.8 allows Chief users to "hide plugins installed by other users." |
CVE-2005-1451 | | | 2005-05-03 | The media manager in Serendipity before 0.8 allows remote attackers to upload and execute arbitrary (1) .php or (2) .shtml files. |
CVE-2005-1450 | | | 2005-05-03 | Unknown vulnerability in "the function used to validate path-names for uploading media" in Serendipity before 0.8 has unknown impact. |
CVE-2005-1449 | | | 2005-05-03 | Unknown vulnerability in serendipity_config_local.inc.php for Serendipity before 0.8 has unknown impact. |
CVE-2005-1448 | | | 2005-05-03 | Cross-site scripting (XSS) vulnerability in the BBCode plugin for Serendipity before 0.8 allows remote attackers to inject arbitrary web script or HTML via unk… |
CVE-2005-1134 | | | 2005-04-13 | SQL injection vulnerability in exit.php for Serendipity 0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) url_id or (2) ent… |
CVE-2004-2525 | | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in compat.php in Serendipity before 0.7.1 allows remote attackers to inject arbitrary web script or HTML via the searc… |
CVE-2004-2158 | | | 2004-12-31 | SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter to (1) exit.php or (2… |
CVE-2004-2157 | | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in Comment.php in Serendipity 0.7 beta1, and possibly other versions before 0.7-beta3, allows remote attackers to inje… |
CVE-2004-1620 | | | 2004-10-21 | CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content fr… |