Skip to content
OpenAdvisories

Package · Packagist

s9y/serendipity

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.2
    CVE-2026-39971

    Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST

    Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without validation, and the existing sanitization …

    s9y Serendipity s9y/serendipity Packagist