S9y Serendipity
59 CVEs affecting S9y Serendipity. Latest disclosed: 2026-07-30. Critical: 4, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10964 | Critical | 9.8 | 2020-03-25 | Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This file may… |
CVE-2011-1134 | Critical | 9.8 | 2019-11-05 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manage… |
CVE-2016-10752 | Critical | 9.8 | 2019-05-24 | serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless fil… |
CVE-2016-10082 | Critical | 9.8 | 2016-12-30 | include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time insta… |
CVE-2026-67351 | High | 8.8 | 2026-07-30 | Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without… |
CVE-2023-53933 | High | 8.8 | 2025-12-17 | Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attack… |
CVE-2023-31576 | High | 8.8 | 2023-05-16 | An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file. |
CVE-2017-8101 | High | 8.8 | 2017-04-24 | There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request. |
CVE-2017-5609 | High | 8.8 | 2017-01-28 | SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via t… |
CVE-2017-5476 | High | 8.8 | 2017-01-14 | Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin. |
CVE-2017-5475 | High | 8.8 | 2017-01-14 | comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments. |
CVE-2016-9752 | High | 8.6 | 2016-12-01 | In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status… |
CVE-2017-1000129 | High | 7.5 | 2017-11-17 | Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure |
CVE-2026-39971 | High | 7.2 | 2026-04-15 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTT… |
CVE-2024-58282 | High | 7.2 | 2025-12-10 | Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media uploa… |
CVE-2026-39963 | Medium | 6.9 | 2026-04-15 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_S… |
CVE-2011-4090 | Medium | 6.1 | 2019-11-26 | Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation. |
CVE-2011-1135 | Medium | 6.1 | 2019-11-05 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/Extended… |
CVE-2011-1133 | Medium | 6.1 | 2019-11-05 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/Extende… |
CVE-2019-11870 | Medium | 6.1 | 2019-05-09 | Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/adm… |