S9Y
S9Y Serendipity: vulnerabilidades y CVE
S9Y Serendipity tiene 58 vulnerabilidades publicadas, 5 de ellas en los últimos 12 meses. 4 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE58
Últimos 12 meses5
Críticas4
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-39971 | Alta (7.2) | 0.30% | — | 15 abr 2026 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without… |
| CVE-2026-39963 | Media (6.9) | 0.30% | — | 15 abr 2026 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] without validation as the domain parameter… |
| CVE-2023-53933 | Alta (8.7) | 1.0% | — | 17 dic 2025 | Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the… |
| CVE-2023-53932 | Media (5.1) | 0.24% | — | 17 dic 2025 | Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through blog entry creation. Attackers can craft entries with JavaScript payloads that… |
| CVE-2024-58282 | Alta (8.6) | 1.0% | — | 10 dic 2025 | Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload… |
| CVE-2023-31576 | Alta (8.8) | 1.1% | — | 16 may 2023 | An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file. |
| CVE-2020-10964 | Crítica (9.8) | 2.8% | — | 25 mar 2020 | Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This file may then be renamed to have a .php filename. |
| CVE-2011-4090 | Media (6.1) | 3.4% | — | 26 nov 2019 | Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation. |
| CVE-2011-1135 | Media (6.1) | 1.8% | — | 5 nov 2019 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/ExtendedFileManager/manager.php and plugins/ImageManager/manager.php. |
| CVE-2011-1134 | Crítica (9.8) | 3.0% | — | 5 nov 2019 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager. |
| CVE-2011-1133 | Media (6.1) | 1.8% | — | 5 nov 2019 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/ExtendedFileManager/backend.php. |
| CVE-2016-10752 | Crítica (9.8) | 2.3% | — | 24 may 2019 | serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless filename during a rename, as demonstrated by "php" as a… |
| CVE-2019-11870 | Media (6.1) | 1.3% | — | 9 may 2019 | Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature. |
| CVE-2016-10737 | Media (5.4) | 0.62% | — | 16 ene 2019 | Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter. |
| CVE-2017-1000129 | Alta (7.5) | 1.1% | — | 17 nov 2017 | Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure |
| CVE-2017-8102 | Media (5.4) | 0.86% | — | 24 abr 2017 | Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipity_event_xsstrust plugin and a… |
| CVE-2017-8101 | Alta (8.8) | 0.60% | — | 24 abr 2017 | There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request. |
| CVE-2017-5609 | Alta (8.8) | 1.6% | — | 28 ene 2017 | SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter. |
| CVE-2017-5476 | Alta (8.8) | 0.69% | — | 14 ene 2017 | Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin. |
| CVE-2017-5475 | Alta (8.8) | 0.56% | — | 14 ene 2017 | comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments. |
| CVE-2017-5474 | Media (6.1) | 0.93% | — | 14 ene 2017 | Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header. |
| CVE-2016-10082 | Crítica (9.8) | 2.9% | — | 30 dic 2016 | include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST… |
| CVE-2016-9681 | Media (5.4) | 1.3% | — | 25 dic 2016 | Multiple cross-site scripting (XSS) vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name. |
| CVE-2016-9752 | Alta (8.6) | 1.1% | — | 1 dic 2016 | In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code. |
| CVE-2015-8603 | Media (5.4) | 1.2% | — | 12 ene 2016 | Cross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the serendipity[entry_id] parameter in an "edit" admin action to… |
| CVE-2015-6969 | Media (4.3) | 1.9% | — | 16 sept 2015 | Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly… |
| CVE-2015-6968 | Media (6.5) | 2.1% | — | 16 sept 2015 | Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by… |
| CVE-2015-6943 | Media (6) | 1.2% | — | 15 sept 2015 | SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote… |
| CVE-2015-2289 | Baja (3.5) | 1.6% | — | 23 mar 2015 | Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name]… |
| CVE-2014-9432 | Media (4.3) | 2.1% | — | 31 dic 2014 | Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.