These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-73629 debrief: Serendipity server-side request forgery vulnerability allows authenticated users to bypass filters and request internal services through the public uploads directory, potentially leading to unauthorized access and data breaches. The vulnerability exists in Serendipity versions before 2.6.0 and requires adminImagesAdd permission. Users should assess exposure and prioritize upgrading [truncated]
A reflected cross-site scripting vulnerability exists in Serendipity versions >= 2.3.5 and <= 2.6.0 in the search clean-URL route. This issue allows a crafted search link to execute arbitrary JavaScript in the victim's browser. The vulnerability was fixed in version 2.6.1. Defenders should assess exposure and apply the patch to prevent potential exploitation. The vulnerability is caused by improper saniti [truncated]
CVE-2026-67350 is an open redirect vulnerability in Serendipity's exit.php file when the Track Exits plugin is configured with commentredirection set to s9y. This allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter. The vulnerability has a CVSS score of 2.1 and is considered low severity.
Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. This HIGH severity vulnerability has a CVSS score of 8.7. Users of Serendipity versions before 2.6.1, particularly those with Editor and Administrator accounts, should review and apply patches to prevent pote [truncated]
CVE-2017-5609 is a high-severity SQL injection issue in Serendipity 2.0.5. According to the official NVD record, a remote authenticated user can trigger arbitrary SQL commands through the cat parameter in include/functions_entries.inc.php. NVD rates the issue CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high impact with relatively low attack complexity.
CVE-2017-5476 affects Serendipity through version 2.0.5. The issue is a cross-site request forgery (CSRF) weakness that can be used to trigger installation of an event plugin or sidebar plugin. Because the action can be induced remotely through a crafted web request and relies on a victim’s authenticated session, it is most relevant to administrators and users with plugin-management access.
CVE-2017-5475 is a cross-site request forgery issue in Serendipity's comment.php. According to NVD, affected versions extend through 2.0.5, and the weakness is classified as CWE-352. The published NVD vector is CVSS 3.0 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which NVD rates as 8.8 HIGH. The issue is referenced by a SecurityFocus BID entry and a Serendipity GitHub issue tracker report.
CVE-2017-5474 is an open redirect vulnerability in Serendipity through 2.0.5, located in comment.php. An attacker can supply a URL in the HTTP Referer header and cause users to be redirected to an arbitrary website, which can be used for phishing. The issue was publicly disclosed on 2017-01-14 and is rated medium severity (CVSS 6.1).