Updated 31 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

353new WordPress flaws this week

390,080entries in the database

74 results · page 1 of 2

Aug 13, 2026Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addreCVE-2026-73629 · Other software · s9y · reported by VulnCheckHigh 8.4
Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Aug 13, 2026Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>).CVE-2026-73628 · Other software · s9y · reported by VulnCheckMedium 5.3
Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encoding, so a single URL-encoded HTML payload survives strip_tags() and htmlspecialchars() and is then decoded back into live HTML in the page. A crafted search link can execute arbitrary JavaScript in the victim's browser. Fixed in 2.6.1.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 31, 2026Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sitesCVE-2026-67350 · Other software · s9y · reported by VulnCheckLow 2.1
Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y. Attackers can craft trusted-looking URLs leveraging the legitimate blog domain to conduct phishing, deliver malware, or bypass URL reputation filters.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 30, 2026Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without CVE-2026-67351 · Other software · s9y · reported by VulnCheckHigh 8.7
Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrator's account data.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Apr 15, 2026Serendipity is a PHP-powered weblog engine.CVE-2026-39971 · Other software · s9y · reported by GitHubHigh 7.2
Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without validation, and the existing sanitization function serendipity_isResponseClean() is not called on HTTP_HOST before embedding it. An attacker who can control the Host header during an email-triggering action such as comment notifications or subscription emails can inject arbitrary SMTP headers into outgoing emails. This enables identity spoofing, reply hijacking via manipulated Message-ID threading, and email reputation abuse through the attacker's domain being embedded in legitimate mail headers. This issue has been fixed in version 2.6.0.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 15, 2026Serendipity is a PHP-powered weblog engine.CVE-2026-39963 · Other software · s9y · reported by GitHubMedium 6.9
Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of setcookie(). An attacker who can influence the Host header at login time, such as via MITM, reverse proxy misconfiguration, or load balancer manipulation, can force authentication cookies including session tokens and auto-login tokens to be scoped to an attacker-controlled domain. This enables session fixation, token leakage to attacker-controlled infrastructure, and privilege escalation if an admin logs in under a poisoned Host header. This issue has been fixed in version 2.6.0.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 17, 2025Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension.CVE-2023-53933 · Other software · s9y · reported by VulnCheckHigh 8.7
Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.s9y.org exploit-db.com
Dec 17, 2025Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through blog entry creation.CVE-2023-53932 · Other software · s9y · reported by VulnCheckMedium 5.1
Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through blog entry creation. Attackers can craft entries with JavaScript payloads that will execute when other users view the compromised blog post.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.s9y.org exploit-db.com
Dec 10, 2025Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media uploadCVE-2024-58282 · Other software · Serendipity · reported by VulnCheckHigh 8.6
Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload mechanism by creating a PHP shell with a command execution form that enables arbitrary system command execution on the web server.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.s9y.org exploit-db.com
May 16, 2023An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file.CVE-2023-31576 · Other software · S9y · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 25, 2020Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot.CVE-2020-10964 · Other software · S9y · reported by MITRECritical 9.8
Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This file may then be renamed to have a .php filename.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org github.com
Jan 22, 2020A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendipity_event_freetag/tCVE-2011-3610 · Other software · Serendipity · reported by Red HatMedium 6.1
A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendipity_event_freetag/tagcloud.swf.
Product
serendipity freetag plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.schokokeks.org packetstormsecurity.com
Nov 26, 2019Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.CVE-2011-4090 · Other software · serendipity · reported by Red HatMedium 6.1
Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.
Product
serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com seclists.org
Nov 5, 2019Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/ExtendedFCVE-2011-1135 · Other software · S9y · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/ExtendedFileManager/manager.php and plugins/ImageManager/manager.php.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org bugs.debian.org
Nov 5, 2019Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image managerCVE-2011-1134 · Other software · S9y · reported by MITRECritical 9.8
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org bugs.debian.org
Nov 5, 2019Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/ExtendedCVE-2011-1133 · Other software · S9y · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/ExtendedFileManager/backend.php.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org bugs.debian.org
May 24, 2019serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless fileCVE-2016-10752 · Other software · S9y · reported by MITRECritical 9.8
serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless filename during a rename, as demonstrated by "php" as a filename.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.ripstech.com demo.ripstech.com
May 9, 2019Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admiCVE-2019-11870 · Other software · S9y · reported by MITREMedium 6.1
Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com blog.s9y.org
Jan 15, 2019Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.CVE-2016-10737 · Other software · S9y · reported by MITREMedium 5.4
Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Nov 17, 2017Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosureCVE-2017-1000129 · Other software · S9y · reported by MITREHigh 7.5
Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org blog.s9y.org
Apr 24, 2017Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user.CVE-2017-8102 · Other software · S9y · reported by MITREMedium 5.4
Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipity_event_xsstrust plugin and a set_config error in that plugin.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Apr 24, 2017There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request.CVE-2017-8101 · Other software · S9y · reported by MITREHigh 8.8
There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Jan 28, 2017SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via thCVE-2017-5609 · Other software · S9y · reported by MITREHigh 8.8
SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com
Jan 14, 2017Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin.CVE-2017-5476 · Other software · S9y · reported by MITREHigh 8.8
Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com
Jan 14, 2017comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments.CVE-2017-5475 · Other software · S9y · reported by MITREHigh 8.8
comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com
Jan 14, 2017Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing atCVE-2017-5474 · Other software · S9y · reported by MITREMedium 6.1
Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com
Dec 30, 2016include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time instalCVE-2016-10082 · Other software · S9y · reported by MITRECritical 9.8
include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include() call in the bundled-libs/serendipity_generateFTPChecksums.php file.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com
Dec 25, 2016Multiple cross-site scripting (XSS) vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a caCVE-2016-9681 · Other software · S9y · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com
Dec 1, 2016In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status CVE-2016-9752 · Other software · S9y · reported by MITREHigh 8.6
In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com blog.s9y.org
Jan 12, 2016Cross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the serendipity[entry_idCVE-2015-8603 · Other software · S9y · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the serendipity[entry_id] parameter in an "edit" admin action to serendipity_admin.php.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org packetstormsecurity.com
Sep 16, 2015Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script CVE-2015-6969 · Other software · S9y · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.curesec.com blog.s9y.org
Sep 16, 2015Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remCVE-2015-6968 · Other software · S9y · reported by MITREMedium 6.5
Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht or (2) .phtml extension.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.curesec.com blog.s9y.org
Sep 15, 2015SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens foCVE-2015-6943 · Other software · S9y · reported by MITREMedium 6
SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote administrators to execute arbitrary SQL commands via the serendipity[id] parameter to serendipity_admin.php.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.curesec.com blog.s9y.org
Mar 23, 2015Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitraryCVE-2015-2289 · Other software · S9y · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, when creating a new category.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org packetstormsecurity.com
Dec 31, 2014Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbiCVE-2014-9432 · Other software · S9y · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY_STRING to serendipity/index.php.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org packetstormsecurity.com
Nov 5, 2013Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly otheCVE-2013-5670 · Other software · S9y · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the to_r_list parameter.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org opensyscom.fr
Aug 19, 2013Cross-site scripting (XSS) vulnerability in serendipity_admin_image_selector.php in Serendipity 1.6.2 and earlier allows remote attackers to inject arbitrary weCVE-2013-5314 · Other software · S9y · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in serendipity_admin_image_selector.php in Serendipity 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the serendipity[htmltarget] parameter.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com mavitunasecurity.com
Aug 13, 2012SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the sCVE-2012-2332 · Other software · S9y · reported by Red HatHigh 7.5
SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the serendipity[plugin_to_conf] parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF).
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com blog.s9y.org
Aug 13, 2012Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1 allows remote attackers to inject arbitCVE-2012-2331 · Other software · S9y · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the serendipity[textarea] parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF).
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com blog.s9y.org
Jun 7, 2012SQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url pCVE-2012-2762 · Other software · S9y · reported by MITREHigh 7.5
SQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url parameter to comment.php.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org secunia.com
Sep 23, 2011Serendipity 1.5.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error mCVE-2011-3800 · Other software · S9y · reported by MITREMedium 5
Serendipity 1.5.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/newspaper/layout.php and certain other files.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.google.com code.google.com
Sep 10, 2010Cross-site scripting (XSS) vulnerability in Serendipity before 1.5.4, when "Remember me" logins are enabled, allows remote attackers to inject arbitrary web scrCVE-2010-2957 · Other software · S9y · reported by Red HatLow 2.6
Cross-site scripting (XSS) vulnerability in Serendipity before 1.5.4, when "Remember me" logins are enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org htbridge.ch
May 12, 2010The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass iCVE-2010-1916 · Other software · Xinha · reported by MITREHigh 7.5
The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced, which are not properly handled by the "Deprecated config passing" feature; or (2) crafted backend_data and backend_data[key_location] variables, which are not properly handled by the xinha_read_passed_data function. NOTE: this can be leveraged to upload and possibly execute arbitrary files via config.inc.php in the ImageManager plugin.
Product
Wysiwyg Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org secunia.com
Dec 24, 2009Unrestricted file upload vulnerability in Serendipity before 1.5 allows remote authenticated users to execute arbitrary code by uploading a file with an executaCVE-2009-4412 · Other software · S9y · reported by MITREMedium 6
Unrestricted file upload vulnerability in Serendipity before 1.5 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in an unspecified directory. NOTE: some of these details are obtained from third party information.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org osvdb.org
Sep 24, 2009SQL injection vulnerability in the Freetag (serendipity_event_freetag) plugin before 3.09 for Serendipity (S9Y) allows remote attackers to execute arbitrary SQLCVE-2009-3337 · Other software · S9y · reported by MITREHigh 7.5
SQL injection vulnerability in the Freetag (serendipity_event_freetag) plugin before 3.09 for Serendipity (S9Y) allows remote attackers to execute arbitrary SQL commands via an unspecified parameter associated with Meta keywords in a blog entry.
Product
Serendipity Event Freetag
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org secunia.com
Jun 22, 2009SerendipityNZ (aka SimpleBoxes) Serene Bach 2.20R and earlier, and 3.00 beta023 and earlier 3.x versions, uses a predictable session id, which makes it easier fCVE-2009-2165 · Other software · Serendipitynz · reported by MITREHigh 7.5
SerendipityNZ (aka SimpleBoxes) Serene Bach 2.20R and earlier, and 3.00 beta023 and earlier 3.x versions, uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id.
Product
Serene Bach
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Apr 23, 2008Cross-site scripting (XSS) vulnerability in the Top Referrers (aka referrer) plugin in Serendipity (S9Y) before 1.3.1 allows remote attackers to inject arbitrarCVE-2008-1385 · Other software · S9y · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Top Referrers (aka referrer) plugin in Serendipity (S9Y) before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com blog.s9y.org
Apr 23, 2008Multiple cross-site scripting (XSS) vulnerabilities in the installer in Serendipity (S9Y) 1.3 allow remote attackers to inject arbitrary web script or HTML via CVE-2008-1386 · Other software · S9y · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the installer in Serendipity (S9Y) 1.3 allow remote attackers to inject arbitrary web script or HTML via (1) unspecified path fields or (2) the database host field. NOTE: the timing window for exploitation of this issue might be limited.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com blog.s9y.org
Mar 24, 2008Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors CVE-2008-1476 · Other software · Serendipity · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to received trackbacks.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org secunia.com
Feb 28, 2008Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via (1) CVE-2008-0124 · Other software · S9y · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via (1) the "Real name" field in Personal Settings, which is presented to readers of articles; or (2) a file upload, as demonstrated by a .htm, .html, or .js file.
Product
Serendipity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.s9y.org int21.de

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.