VendorsS9Yserendipity1.5.3
Vulnerabilities

S9Y Serendipity 1.5.3

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

5CVEs
CVE-2012-2762
SQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url parameter to comment.php.
Published 2012-06-07 · Modified
7.5EPSS 0.022
CVE-2012-2332
SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the serendipity[plugin_to_conf] parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF).
Published 2012-08-13 · Modified
7.51 PoCEPSS 0.017
CVE-2012-2331
Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the serendipity[textarea] parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF).
Published 2012-08-13 · Modified
4.31 PoCEPSS 0.047
CVE-2013-5314
Cross-site scripting (XSS) vulnerability in serendipity_admin_image_selector.php in Serendipity 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the serendipity[htmltarget] parameter.
Published 2013-08-19 · Modified
4.31 PoCEPSS 0.016
CVE-2013-5670
Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the to_r_list parameter.
Published 2013-11-05 · Modified
4.3EPSS 0.012