Skip to content
OpenAdvisories

Vendor

s9y

8 known vulnerabilities.

Products

Serendipity 8
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-73628

    Serendipity 2.3.5 Reflected XSS via search clean-URL route

    Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encodin…

    s9y Serendipity
  • Medium 4.3
    CVE-2026-67350

    Serendipity < 2.6.1 Open Redirect via exit.php

    Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured wi…

    s9y Serendipity
  • Medium 6.9
    CVE-2026-39963

    Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain

    Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of setcookie(). An attacker who can inf…

    s9y Serendipity s9y/serendipity Packagist
  • Medium 5.4
    CVE-2023-53932

    Serendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry Creation

    Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through blog entry creation. Attackers can craft entries with JavaScript payloads that will execute when other users view the co…

    s9y Serendipity