S9y

Serendipity

56 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2016-9681

Exploit
  • EPSS 0.24%
  • Veröffentlicht 25.12.2016 17:59:00
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name.

8.6

CVE-2016-9752

  • EPSS 0.19%
  • Veröffentlicht 01.12.2016 11:59:11
  • Zuletzt bearbeitet 12.04.2025 10:46:40

In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.

5.4

CVE-2015-8603

Exploit
  • EPSS 0.19%
  • Veröffentlicht 12.01.2016 19:59:12
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the serendipity[entry_id] parameter in an "edit" admin action to serendipity_admin.php.

4.3

CVE-2015-6969

Exploit
  • EPSS 0.34%
  • Veröffentlicht 16.09.2015 14:59:11
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link.

6.5

CVE-2015-6968

Exploit
  • EPSS 0.81%
  • Veröffentlicht 16.09.2015 14:59:10
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht ...

6

CVE-2015-6943

Exploit
  • EPSS 0.25%
  • Veröffentlicht 15.09.2015 18:59:01
  • Zuletzt bearbeitet 12.04.2025 10:46:40

SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote administrators to execute arbitrary SQL co...

3.5

CVE-2015-2289

Exploit
  • EPSS 0.29%
  • Veröffentlicht 23.03.2015 16:59:01
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, whe...

4.3

CVE-2014-9432

Exploit
  • EPSS 0.42%
  • Veröffentlicht 31.12.2014 22:59:08
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY_STRING to serendipity/index.php.

4.3

CVE-2013-5670

  • EPSS 0.33%
  • Veröffentlicht 05.11.2013 18:55:06
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the to_r_li...

4.3

CVE-2013-5314

Exploit
  • EPSS 0.42%
  • Veröffentlicht 19.08.2013 21:10:49
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in serendipity_admin_image_selector.php in Serendipity 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the serendipity[htmltarget] parameter.