GCVE - cpe:2.3:a:s9y:serendipity:2.4.0:beta1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:s9y:serendipity:2.4.0:beta1:*:*:*:*:*:*

part: a version: 2.4.0 update: beta1

Vendor	S9Y (`0745c483-6e7d-5cc0-b939-7ad3e8e7483a`)
Product	Serendipity (`80910be0-a47c-54b9-b1e6-b7600f9312ab`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/s9y/serendipity`	purl2cpe	2026-06-01 10:11:20.018859

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-73628`	vulnerable	2026-09-16 04:33:09.603401	Serendipity 2.3.5 Reflected XSS via search clean-URL route MEDIUM (6.1) Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encoding, so a single URL-encoded HTML payload survives strip_tags() and htmlspecialchars() and is then decoded back into live HTML in the page. A crafted search link can execute arbitrary JavaScript in the victim's browser. Fixed in 2.6.1. Published: 2026-08-13T11:28:26.954Z Updated: 2026-09-30T17:20:28.073Z Open on db.gcve.eu Reference links https://github.com/s9y/Serendipity/security/advisories/GHSA-6c2x-mjmq-vx4q https://www.vulncheck.com/advisories/serendipity-reflected-xss-via-search-clean-url-route	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-53933`	vulnerable	2026-06-08 06:19:40.049755	Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload HIGH (8.8) Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server. Published: 2025-12-17T22:44:59.632Z Updated: 2026-04-07T14:07:53.832Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/51372 https://docs.s9y.org/ https://www.vulncheck.com/advisories/serendipity-authenticated-remote-code-execution-via-file-upload	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-53932`	vulnerable	2026-06-08 06:19:40.047687	Serendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry Creation MEDIUM (5.4) Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through blog entry creation. Attackers can craft entries with JavaScript payloads that will execute when other users view the compromised blog post. Published: 2025-12-17T22:44:59.094Z Updated: 2026-04-07T14:07:52.589Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/51373 https://docs.s9y.org/ https://www.vulncheck.com/advisories/serendipity-stored-cross-site-scripting-via-admin-entry-creation	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-31576`	vulnerable	2026-06-08 06:04:43.379685	Details available An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file. Published: 2023-05-16T00:00:00.000Z Updated: 2025-01-23T17:07:41.986Z Open on db.gcve.eu Reference links https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/s9y/2023/Serendipity-2.4-beta-1	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.