CVE-2011-4090

MEDIUM

Serendipity < 1.6 - Cross-Site Scripting in Karma Plugin

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2011-4090. PoCs published by Stefan Schurtz.

AI-analyzed exploit summary This exploit demonstrates a reflected XSS vulnerability in Serendipity 1.5.5 by injecting a malicious script via the 'serendipity[filter][bp.ALT]' parameter, which executes arbitrary JavaScript in the context of the affected site.

Description

Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Stefan Schurtz · textwebappsphp
https://www.exploit-db.com/exploits/36283

This exploit demonstrates a reflected XSS vulnerability in Serendipity 1.5.5 by injecting a malicious script via the 'serendipity[filter][bp.ALT]' parameter, which executes arbitrary JavaScript in the context of the affected site.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Serendipity 1.5.5
No auth needed
Prerequisites: Access to the vulnerable Serendipity admin image selector page
MITRE ATT&CK
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
https://security-tracker.debian.org/tracker/CVE-2011-4090
Mailing List, Third Party Advisory x_refsource_misc
https://seclists.org/oss-sec/2011/q4/176

Scores

CVSS v3 6.1
EPSS 0.0311
EPSS Percentile 86.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
s9y/serendipity < 1.6
Published Nov 26, 2019
Tracked Since Feb 18, 2026