s9y serendipity 2.0.5 vulnerabilities and exploits

(subscribe to this query)

6.8

CVSSv2

There is CSRF in Serendipity 2.0.5, allowing malicious users to install any themes via a GET request.

S9y Serendipity 2.0.5

6.5

CVSSv2

SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter.

S9y Serendipity 2.0.5

6.8

CVSSv2

comment.php in Serendipity up to and including 2.0.5 allows CSRF in deleting any comments.

S9y Serendipity

6.8

CVSSv2

Serendipity up to and including 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin.

S9y Serendipity

5

CVSSv2

In Serendipity prior to 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.

S9y Serendipity

3.5

CVSSv2

Multiple cross-site scripting (XSS) vulnerabilities in Serendipity prior to 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name.

S9y Serendipity

5.8

CVSSv2

Open redirect vulnerability in comment.php in Serendipity up to and including 2.0.5 allows remote malicious users to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header.

S9y Serendipity

7.5

CVSSv2

include/functions_installer.inc.php in Serendipity up to and including 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include() call in the b...

S9y Serendipity

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook