S9y vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-73629 Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addreHigh 8.4 · Aug 13, 2026
• CVE-2026-67351 Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without High 8.7 · Jul 30, 2026
• CVE-2026-39971 Serendipity is a PHP-powered weblog engine.High 7.2 · Apr 15, 2026
• CVE-2023-53933 Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension.High 8.7 · Dec 17, 2025
• CVE-2023-31576 An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file.High 8.8 · May 16, 2023
• CVE-2020-10964 Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot.Critical 9.8 · Mar 25, 2020
• CVE-2011-1134 Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image managerCritical 9.8 · Nov 5, 2019
• CVE-2016-10752 serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless fileCritical 9.8 · May 24, 2019
• CVE-2017-1000129 Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosureHigh 7.5 · Nov 17, 2017
• CVE-2017-8101 There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request.High 8.8 · Apr 24, 2017
• CVE-2017-5609 SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via thHigh 8.8 · Jan 28, 2017
• CVE-2017-5476 Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin.High 8.8 · Jan 14, 2017
• CVE-2017-5475 comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments.High 8.8 · Jan 14, 2017
• CVE-2016-10082 include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time instalCritical 9.8 · Dec 30, 2016
• CVE-2016-9752 In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status High 8.6 · Dec 1, 2016
• CVE-2012-2332 SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the sHigh 7.5 · Aug 13, 2012
• CVE-2012-2762 SQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url pHigh 7.5 · Jun 7, 2012
• CVE-2009-3337 SQL injection vulnerability in the Freetag (serendipity_event_freetag) plugin before 3.09 for Serendipity (S9Y) allows remote attackers to execute arbitrary SQLHigh 7.5 · Sep 24, 2009
• CVE-2006-2495 Cross-site request forgery (CSRF) vulnerability in the Entry Manager in Serendipity before 1.0-beta3 allows remote attackers to perform unauthorized actions as High 7.5 · May 19, 2006
• CVE-2006-1910 config.php in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values that are stored in config.php and later executedHigh 7.5 · Apr 20, 2006
• CVE-2005-1449 Unknown vulnerability in serendipity_config_local.inc.php for Serendipity before 0.8 has unknown impact.High 10 · May 3, 2005
• CVE-2005-1450 Unknown vulnerability in "the function used to validate path-names for uploading media" in Serendipity before 0.8 has unknown impact.High 7.5 · May 3, 2005
• CVE-2005-1451 The media manager in Serendipity before 0.8 allows remote attackers to upload and execute arbitrary (1) .php or (2) .shtml files.High 7.5 · May 3, 2005
• CVE-2005-1452 Serendipity before 0.8 allows Chief users to "hide plugins installed by other users."High 10 · May 3, 2005
• CVE-2005-1134 SQL injection vulnerability in exit.php for Serendipity 0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) url_id or (2) entrHigh 7.5 · Apr 13, 2005