s9y Serendipity vulnerabilities

62 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Latest s9y Serendipity vulnerabilities

CVE-2026-73629 — Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses (CVSS 8.5)
CVE-2026-73628 — Serendipity 2.3.5 Reflected XSS via search clean-URL route (CVSS 6.1)
CVE-2026-67350 — Serendipity < 2.6.1 Open Redirect via exit.php (CVSS 4.3)
CVE-2026-67351 — Serendipity < 2.6.1 Authentication Bypass via Username Collision (CVSS 8.8)
CVE-2026-39971 — Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST (CVSS 7.2)
CVE-2026-39963 — Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain (CVSS 6.9)
CVE-2023-53933 — Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload (CVSS 8.8)
CVE-2023-53932 — Serendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry Creation (CVSS 5.4)
CVE-2024-58282 — Serendipity 2.5.0 Remote Code Execution via Authenticated Media Upload (CVSS 7.2)
CVE-2023-31576 — (CVSS 8.8)
CVE-2020-10964 — (CVSS 9.8)
CVE-2011-4090 — (CVSS 6.1)
CVE-2011-1135 — (CVSS 6.1)
CVE-2011-1134 — (CVSS 9.8)
CVE-2011-1133 — (CVSS 6.1)
CVE-2016-10752 — (CVSS 9.8)
CVE-2019-11870 — (CVSS 6.1)
CVE-2016-10737 — (CVSS 5.4)
CVE-2017-1000129 — (CVSS 7.5)
CVE-2017-8102 — (CVSS 5.4)
CVE-2017-8101 — (CVSS 8.8)
CVE-2017-5609 — (CVSS 8.8)
CVE-2017-5476 — (CVSS 8.8)
CVE-2017-5475 — (CVSS 8.8)
CVE-2017-5474 — (CVSS 6.1)