CVE-2017-5474

Open redirect vulnerability CVE-2017-5474 affects Serendipity up to version 2.0.5 in comment.php. The issue arises from improper validation of the HTTP Referer header, enabling remote attackers to direct users to arbitrary sites (potential phishing). Affected product/component: Serendipity (comme...

CVE-2017-5475

comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments...

CVE-2017-5476

Serendipity

CVE-2017-5476

Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin...

Serendipity Arbitrary File Containment Vulnerability

Serendipity is a PHP-based blogging system developed by Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A security vulnerability exists in the file include/functionsinstaller.inc.php in Serendipity 2.0.5 and earlier versions, which stems from the...

Code injection

include/functionsinstaller.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include call in the...

CVE-2016-10082

include/functionsinstaller.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include call in the...

CVE-2016-10082

include/functionsinstaller.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include call in the...

CVE-2016-10082

include/functionsinstaller.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include call in the...

CVE-2016-10082

The CVE-2016-10082 entry concerns Serendipity up to version 2.0.5. The vulnerability is a File Inclusion flaw in include/functions_installer.inc.php (and related code path in bundled-libs/serendipity_generateFTPChecksums.php) caused by unsanitized dbType POST input during first-time installation,...

CVE-2016-10082

include/functionsinstaller.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include call in the...

Serendipity 'serendipity_admin.php' Cross-Site Scripting Vulnerability

Serendipity is a PHP-based blogging system developed by Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A cross-site scripting vulnerability exists in Serendipity versions prior to 2.0.5. A remote attacker can exploit this vulnerability to inject...

CVE-2016-9681

Multiple cross-site scripting XSS vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name...

CVE-2016-9681

Multiple cross-site scripting XSS vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name...

CVE-2016-9681

Multiple cross-site scripting XSS vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name...

CVE-2016-9681

CVE-2016-9681 concerns Serendipity (PHP-based blog) versions prior to 2.0.5. The vulnerability is a stored XSS in the templates/2k11/admin/category.inc.tpl caused by improper validation of category/directory names, exploitable by an authenticated remote attacker to inject arbitrary script/HTML. T...

CVE-2016-9681

Multiple cross-site scripting XSS vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name...

Serendipity 2.0.3: From File Upload to Code Execution

RIPS Analysis The analysis of Serendipity with RIPS took 67 seconds to complete. The total amount of issues is reasonable for a web application of this size. Most of the 36 low severe issues detected are information leakage issues, for example, when an error message leaks the DBMS system of a...

Serendipity SSRF Security Restriction Bypass Vulnerability

Serendipity is the scalable PHP-powered weblog engine. Serendipity suffers from a Security Restriction Bypass vulnerability that allows an attacker to bypass SSRF protection via a malformed IP address or 30x HTTP status code...