S9y

Serendipity

62 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2015-6968

Exploit
  • EPSS 2.07%
  • Veröffentlicht 16.09.2015 14:59:10
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht ...

6

CVE-2015-6943

Exploit
  • EPSS 1.25%
  • Veröffentlicht 15.09.2015 18:59:01
  • Zuletzt bearbeitet 06.05.2026 22:30:45

SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote administrators to execute arbitrary SQL co...

3.5

CVE-2015-2289

Exploit
  • EPSS 1.64%
  • Veröffentlicht 23.03.2015 16:59:01
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, whe...

4.3

CVE-2014-9432

Exploit
  • EPSS 2.14%
  • Veröffentlicht 31.12.2014 22:59:08
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY_STRING to serendipity/index.php.

4.3

CVE-2013-5670

  • EPSS 1.18%
  • Veröffentlicht 05.11.2013 18:55:06
  • Zuletzt bearbeitet 29.04.2026 01:13:23

Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the to_r_li...

4.3

CVE-2013-5314

Exploit
  • EPSS 1.61%
  • Veröffentlicht 19.08.2013 21:10:49
  • Zuletzt bearbeitet 29.04.2026 01:13:23

Cross-site scripting (XSS) vulnerability in serendipity_admin_image_selector.php in Serendipity 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the serendipity[htmltarget] parameter.

7.5

CVE-2012-2332

Exploit
  • EPSS 1.66%
  • Veröffentlicht 13.08.2012 23:55:02
  • Zuletzt bearbeitet 16.06.2026 23:41:22

SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the serendipity[plugin_to_conf] parameter. NOTE: this issue might be resultant from cross-site...

4.3

CVE-2012-2331

Exploit
  • EPSS 4.68%
  • Veröffentlicht 13.08.2012 23:55:02
  • Zuletzt bearbeitet 16.06.2026 23:41:22

Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the serendipity[textarea] parameter. NOTE: this issue might b...

7.5

CVE-2012-2762

  • EPSS 2.22%
  • Veröffentlicht 07.06.2012 19:55:09
  • Zuletzt bearbeitet 16.06.2026 23:42:02

SQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url parameter to comment.php.

5

CVE-2011-3800

  • EPSS 1.23%
  • Veröffentlicht 24.09.2011 00:55:03
  • Zuletzt bearbeitet 16.06.2026 23:33:57

Serendipity 1.5.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/newspaper/layout.php and certain other files.