S9y

Serendipity

58 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2017-5474

  • EPSS 0.16%
  • Veröffentlicht 14.01.2017 07:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header.

9.8

CVE-2016-10082

  • EPSS 1.53%
  • Veröffentlicht 30.12.2016 07:59:00
  • Zuletzt bearbeitet 12.04.2025 10:46:40

include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an inclu...

5.4

CVE-2016-9681

Exploit
  • EPSS 0.24%
  • Veröffentlicht 25.12.2016 17:59:00
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name.

8.6

CVE-2016-9752

  • EPSS 0.19%
  • Veröffentlicht 01.12.2016 11:59:11
  • Zuletzt bearbeitet 12.04.2025 10:46:40

In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.

5.4

CVE-2015-8603

Exploit
  • EPSS 0.19%
  • Veröffentlicht 12.01.2016 19:59:12
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the serendipity[entry_id] parameter in an "edit" admin action to serendipity_admin.php.

4.3

CVE-2015-6969

Exploit
  • EPSS 0.34%
  • Veröffentlicht 16.09.2015 14:59:11
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link.

6.5

CVE-2015-6968

Exploit
  • EPSS 0.81%
  • Veröffentlicht 16.09.2015 14:59:10
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht ...

6

CVE-2015-6943

Exploit
  • EPSS 0.25%
  • Veröffentlicht 15.09.2015 18:59:01
  • Zuletzt bearbeitet 12.04.2025 10:46:40

SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote administrators to execute arbitrary SQL co...

3.5

CVE-2015-2289

Exploit
  • EPSS 0.29%
  • Veröffentlicht 23.03.2015 16:59:01
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, whe...

4.3

CVE-2014-9432

Exploit
  • EPSS 0.42%
  • Veröffentlicht 31.12.2014 22:59:08
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY_STRING to serendipity/index.php.