S9y Serendipity 2.4.0
Approved changes feed: RSS · Atom
cpe:2.3:a:s9y:serendipity:2.4.0:-:*:*:*:*:*:*
part: a version: 2.4.0 update: -
| Vendor | S9Y (0745c483-6e7d-5cc0-b939-7ad3e8e7483a) |
|---|---|
| Product | Serendipity (80910be0-a47c-54b9-b1e6-b7600f9312ab) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/s9y/serendipity |
purl2cpe | 2026-06-01 10:11:20.018858 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-73628 |
vulnerable | 2026-09-16 04:33:09.600806 |
Serendipity 2.3.5 Reflected XSS via search clean-URL route
MEDIUM (6.1)
Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encoding, so a single URL-encoded HTML payload survives strip_tags() and htmlspecialchars() and is then decoded back into live HTML in the page. A crafted search link can execute arbitrary JavaScript in the victim's browser. Fixed in 2.6.1.
Published: 2026-08-13T11:28:26.954Z
Updated: 2026-09-30T17:20:28.073Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-53933 |
vulnerable | 2026-06-08 06:19:40.049786 |
Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload
HIGH (8.8)
Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.
Published: 2025-12-17T22:44:59.632Z
Updated: 2026-04-07T14:07:53.832Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-53932 |
vulnerable | 2026-06-08 06:19:40.049168 |
Serendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry Creation
MEDIUM (5.4)
Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through blog entry creation. Attackers can craft entries with JavaScript payloads that will execute when other users view the compromised blog post.
Published: 2025-12-17T22:44:59.094Z
Updated: 2026-04-07T14:07:52.589Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.