S9y

Serendipity

53 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2015-6969

Exploit
  • EPSS 0.34%
  • Veröffentlicht 16.09.2015 14:59:11
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link.

6.5

CVE-2015-6968

Exploit
  • EPSS 0.81%
  • Veröffentlicht 16.09.2015 14:59:10
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht ...

6

CVE-2015-6943

Exploit
  • EPSS 0.25%
  • Veröffentlicht 15.09.2015 18:59:01
  • Zuletzt bearbeitet 12.04.2025 10:46:40

SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote administrators to execute arbitrary SQL co...

3.5

CVE-2015-2289

Exploit
  • EPSS 0.34%
  • Veröffentlicht 23.03.2015 16:59:01
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, whe...

4.3

CVE-2014-9432

Exploit
  • EPSS 0.42%
  • Veröffentlicht 31.12.2014 22:59:08
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY_STRING to serendipity/index.php.

4.3

CVE-2013-5670

  • EPSS 0.33%
  • Veröffentlicht 05.11.2013 18:55:06
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the to_r_li...

4.3

CVE-2013-5314

Exploit
  • EPSS 0.42%
  • Veröffentlicht 19.08.2013 21:10:49
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in serendipity_admin_image_selector.php in Serendipity 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the serendipity[htmltarget] parameter.

7.5

CVE-2012-2332

Exploit
  • EPSS 1.33%
  • Veröffentlicht 13.08.2012 23:55:02
  • Zuletzt bearbeitet 11.04.2025 00:51:21

SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the serendipity[plugin_to_conf] parameter. NOTE: this issue might be resultant from cross-site...

4.3

CVE-2012-2331

Exploit
  • EPSS 14.79%
  • Veröffentlicht 13.08.2012 23:55:02
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the serendipity[textarea] parameter. NOTE: this issue might b...

7.5

CVE-2012-2762

  • EPSS 0.72%
  • Veröffentlicht 07.06.2012 19:55:09
  • Zuletzt bearbeitet 11.04.2025 00:51:21

SQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url parameter to comment.php.