CVE-2026-39963

The CVE describes a vulnerability in Serendipity (PHP weblog engine) where the function serendipity_setCookie() in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] as the cookie domain without validation for versions 2.6-beta2 and earlier. An attacker who can influence the Host header ...

CVE-2026-39963 Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain

Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipitysetCookie function in include/functionsconfig.inc.php uses $SERVER'HTTPHOST' without validation as the domain parameter of setcookie. An attacker who can influence the Host header at login time, such as vi...

CVE-2025-27794

Summary: CVE-2025-27794 affects Flarum versions prior to 1.8.10, where an attacker-controlled authoritative subdomain can set cookies for the parent domain, potentially enabling session hijacking on sibling subdomains. What is affected: Flarum core (pre-1.8.10) with cookies scoped to a parent dom...