Skip to content
Noroxi

s9y records

61 published records for vendor s9y.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
12
With a fix record
6.6%
Median publish → KEV
No record has entered KEV

Records by year

  1. 16
  2. 17
  3. 19
  4. 20
  5. 23
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

61 records
  • CVE-2011-1134
    40Plan

    Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code

    CriticalCVSS 9.8No exploitEPSS 3%

    s9y · serendipityNov 5, 2019

  • CVE-2016-10082
    40Plan

    include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during

    CriticalCVSS 9.8No exploitEPSS 2%

    s9y · serendipityDec 30, 2016

  • CVE-2020-10964
    40Plan

    Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a

    CriticalCVSS 9.8No exploitEPSS 2%

    s9y · serendipityMar 25, 2020

  • CVE-2016-10752
    40Plan

    serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles a

    CriticalCVSS 9.8No exploitEPSS 2%

    s9y · serendipityMay 24, 2019

  • CVE-2005-1449
    40Plan

    Unknown vulnerability in serendipity_config_local.inc.php for Serendipity before 0.8 has unknown impact.

    CriticalCVSS 10.0No exploitEPSS 1%

    s9y · serendipityMay 3, 2005

  • CVE-2005-1452
    40Plan

    Serendipity before 0.8 allows Chief users to "hide plugins installed by other users."

    CriticalCVSS 10.0No exploitEPSS 1%

    s9y · serendipityMay 3, 2005

  • CVE-2017-5609
    35Monitor

    SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary

    HighCVSS 8.8No exploitEPSS 1%

    s9y · serendipityJan 28, 2017

  • CVE-2023-31576
    35Monitor

    An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript

    HighCVSS 8.8No exploitEPSS 1%

    s9y · serendipityMay 16, 2023

  • CVE-2017-5476
    35Monitor

    Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin.

    HighCVSS 8.8No exploitEPSS 0%

    s9y · serendipityJan 14, 2017

  • CVE-2017-8101
    35Monitor

    There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request.

    HighCVSS 8.8No exploitEPSS 0%

    s9y · serendipityApr 24, 2017

  • CVE-2017-5475
    35Monitor

    comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments.

    HighCVSS 8.8No exploitEPSS 0%

    s9y · serendipityJan 14, 2017

  • CVE-2024-58282
    34Monitor

    Serendipity 2.5.0 Remote Code Execution via Authenticated Media Upload

    HighCVSS 8.6No exploitEPSS 1%

    s9y · serendipityDec 10, 2025

  • CVE-2016-9752
    34Monitor

    In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redir

    HighCVSS 8.6No exploitEPSS 1%

    s9y · serendipityDec 1, 2016

  • CVE-2023-53933
    34Monitor

    Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload

    HighCVSS 8.7No exploitEPSS 1%

    s9y · serendipityDec 17, 2025

  • CVE-2004-2158
    31Monitor

    SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter to

    HighCVSS 7.5Proof of conceptEPSS 4%

    s9y · serendipityDec 31, 2004

  • CVE-2010-1916
    31Monitor

    The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote a

    HighCVSS 7.5No exploitEPSS 3%

    xinha · wysiwyg editorMay 12, 2010

  • CVE-2012-2762
    31Monitor

    SQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL co

    HighCVSS 7.5No exploitEPSS 2%

    s9y · serendipityJun 7, 2012

  • CVE-2005-1134
    31Monitor

    SQL injection vulnerability in exit.php for Serendipity 0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the (1

    HighCVSS 7.5Proof of conceptEPSS 1%

    s9y · serendipityApr 13, 2005

  • CVE-2012-2332
    30Monitor

    SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQ

    HighCVSS 7.5Proof of conceptEPSS 1%

    s9y · serendipityAug 13, 2012

  • CVE-2006-2495
    30Monitor

    Cross-site request forgery (CSRF) vulnerability in the Entry Manager in Serendipity before 1.0-beta3 allows remote attackers to perform unau

    HighCVSS 7.5No exploitEPSS 1%

    s9y · serendipityMay 19, 2006

  • CVE-2005-1451
    30Monitor

    The media manager in Serendipity before 0.8 allows remote attackers to upload and execute arbitrary (1) .php or (2) .shtml files.

    HighCVSS 7.5No exploitEPSS 1%

    s9y · serendipityMay 3, 2005

  • CVE-2006-1910
    30Monitor

    config.php in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values that are stored in config.ph

    HighCVSS 7.5No exploitEPSS 1%

    s9y · serendipityApr 20, 2006

  • CVE-2009-3337
    30Monitor

    SQL injection vulnerability in the Freetag (serendipity_event_freetag) plugin before 3.09 for Serendipity (S9Y) allows remote attackers to e

    HighCVSS 7.5No exploitEPSS 1%

    s9y · serendipity event freetagSep 24, 2009

  • CVE-2005-1450
    30Monitor

    Unknown vulnerability in "the function used to validate path-names for uploading media" in Serendipity before 0.8 has unknown impact.

    HighCVSS 7.5No exploitEPSS 1%

    s9y · serendipityMay 3, 2005

  • CVE-2017-1000129
    30Monitor

    Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure

    HighCVSS 7.5No exploitEPSS 1%

    s9y · serendipityNov 17, 2017