Serendipity : Security Vulnerabilities, CVEs,
Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to received trackbacks.
Max CVSS
4.3
EPSS Score
0.27%
Published
2008-03-24
Updated
2017-08-08
Cross-site request forgery (CSRF) vulnerability in the mycalendar plugin before 0.13 for Serendipity allows remote attackers to perform actions as blog administrators, which can be leveraged to conduct cross-site scripting (XSS) attacks on the blog page.
Max CVSS
4.3
EPSS Score
0.12%
Published
2007-12-17
Updated
2008-09-05
The "Extended properties for entries" (entryproperties) plugin in serendipity_event_entryproperties.php in Serendipity 1.1.3 allows remote authenticated users to bypass password protection and "deliver custom entryproperties settings to the Serendipity Frontend" via a certain request that modifies the password being checked.
Max CVSS
5.0
EPSS Score
1.51%
Published
2007-08-09
Updated
2017-07-29
SQL injection vulnerability in index.php in Serendipity 1.1.1 allows remote attackers to execute arbitrary SQL commands via the serendipity[multiCat][] parameter.
Max CVSS
7.5
EPSS Score
0.31%
Published
2007-03-07
Updated
2018-10-16
Multiple cross-site scripting (XSS) vulnerabilities in Serendipity (s9y) 1.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in the media manager administration page.
Max CVSS
6.8
EPSS Score
3.93%
Published
2006-10-25
Updated
2018-10-17
5 vulnerabilities found