CVE-2026-39971

Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $SERVER'HTTPHOST' directly into the Message-ID SMTP header without validation, and the existing sanitization function serendipityisResponseClean is not...

CVE-2026-39971 Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST

Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $SERVER'HTTPHOST' directly into the Message-ID SMTP header without validation, and the existing sanitization function serendipityisResponseClean is not...

Serendipity Cross-Site Scripting Vulnerability

Serendipity is scalable PHP-driven weblog engine. A cross-site scripting vulnerability exists in Serendipity version 2.1-rc1. A remote attacker can exploit this vulnerability to steal administrator cookies or other information...

Serendipity Cross-Site Request Forgery Vulnerability

Serendipity is scalable PHP-powered weblog engine. A cross-site request forgery vulnerability in Serendipity 2.0.5 allows attackers to install any theme via a GET request...

Serendipity HTML Injection Vulnerability

Serendipity is a PHP-powered Weblog application. Serendipity suffers from an HTML injection vulnerability because it fails to filter user-supplied input. Allowing an attacker to run supplied HTML or JavaScript code in the context of the affected site...

Serendipity Weblog SQL Injection

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

S9Y Serendipity 0.7-beta1 - SQL Injection

Proof of Concept 1 ------------------ Usage: ./sersqlipoc.sh URLtoSerendipityWeblog sersqlipoc.sh ---------8-----------8------------- !/bin/sh echo -n "Username: " curl -I -s "$1/exit.php?urlid=1&entryid=1%20and%200%20union%20select%20username%20from%20serendipityauthors%20where%20authorid%3D1" |...

Serendipity 0.7-beta1 SQL Injection Proof of Concept

No description provided by source. Proof of Concept 1 ------------------ Usage: ./sersqlipoc.sh URLtoSerendipityWeblog sersqlipoc.sh ---------8-----------8------------- !/bin/sh echo -n "Username: " curl -I -s...