Skip to content
OpenAdvisories

Package · Packagist

s9y/serendipity

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.9
    CVE-2026-39963

    Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain

    Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of setcookie(). An attacker who can inf…

    s9y Serendipity s9y/serendipity Packagist