Skip to content
OpenAdvisories

Package · Packagist

s9y/serendipity

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.2
    CVE-2026-39971

    Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST

    Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without validation, and the existing sanitization …

    s9y Serendipity s9y/serendipity Packagist
  • Medium 6.9
    CVE-2026-39963

    Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain

    Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of setcookie(). An attacker who can inf…

    s9y Serendipity s9y/serendipity Packagist