CVE-2019-11870

Serendipity before 2.1.5 is affected by a cross‑site scripting (XSS) vulnerability via EXIF data mishandled by the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature. Affected products are Serendipity prior to 2.1.5; upst...

serendipity -- XSS

MITRE: Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/mediachoose.tpl Editor Preview feature or the templates/2k11/admin/mediaitems.tpl Media Library feature...

Serendipity Cross-Site Scripting Vulnerability (CNVD-2019-01717)

Serendipity is a PHP-based blogging system developed by Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A cross-site scripting vulnerability exists in Serendipity version 2.0.4, which can be exploited by a remote attacker to inject arbitrary web...

Default credentials

Serendipity 2.0.4 has XSS via the serendipityadmin.php serendipitybody parameter...

CVE-2016-10737

Serendipity 2.0.4 has XSS via the serendipityadmin.php serendipitybody parameter...

CVE-2016-10737

Serendipity 2.0.4 has XSS via the serendipityadmin.php serendipitybody parameter...

CVE-2016-10737

Serendipity 2.0.4 has XSS via the serendipityadmin.php serendipitybody parameter...

CVE-2016-10737

The CVE-2016-10737 entry concerns Serendipity 2.0.4 with a reflected XSS via the serendipity_admin.php serendipity[body] parameter. Affected software is Serendipity (PHP-based blogging system); vulnerability details indicate that arbitrary script/HTML can be injected, potentially leaking informat...

FreeBSD : Serendipity -- multiple vulnerabilities (01018916-c47c-11e8-8b07-00e04c1ea73d)

Serendipity reports : Security: Fix XSS for pagination, when multi-category selection is used. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistributi...

Serendipity -- multiple vulnerabilities

Serendipity reports: Security: Fix XSS for pagination, when multi-category selection is used...

Hanno's projects: SQL injection in Serendipity (serendipity_fetchComments)

Summary An authenticated administrator can alter Entries to display on frontpage and Entries to display in Feeds in a way to perform a SQL injection and extract database records or access files on the underlying system. Description The function serendipityfetchComments implemented in...

Hanno's projects: Reflected xss in Serendipity's /index.php

Summary: There exists a reflected xss threat in https://blog.fuzzing-project.org/index.php?frontpage. Description: By setting the serendipity%5bmultiCat%5d%5b%5d POST input to 1'"&%prompt1 I'm able to trigger a JavaScript prompt box in versions of IE up to and including IE 11. Steps To Reproduce:...

Hanno's projects: blind sql injection

Summary: There exists a possibility that your Serendipity installation is vulnerable to a blind sql injection. Description: By sending specially crafted SQL commands to /plugin/tag/ and timing how long it takes for the server to respond, it is quite possible that the blog backend is interepreting...

Hanno's projects: Reflected Cross-Site Scripting in Serendipity (serendipity.SetCookie)

Summary The Smarty template responsible of creating JavaScript snippets assigning cookies to users is during sorting of entries in the administration interface is affected by a reflected cross-site scripting. Description In templates/2k11/admin/entries.inc.tpl, the following code is dynamically...

Hanno's projects: Open redirect in Serendipity (exit.php)

Summary Serendipity contains a script named exit.php that can be directly accessed. When crafting an hyperlink pointing to this page with the parameter url containing a base64-encoded URL, it will redirect the user to this URL. Description The file exit.php contains the following code: php ?php /...

Serendipity blog component SQL injection vulnerability

Serendipity is a PHP-based blogging system. The system supports the creation of online diaries, blogs, web pages, etc. blog component is one of the blogging components. A SQL injection vulnerability exists in the blog component in Serendipity version 2.0.3. A remote attacker can exploit this...

Sql injection

Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure...

CVE-2017-1000129

Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure...

CVE-2017-1000129

Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure...

CVE-2017-1000129

Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure...