Description
Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, when creating a new category.
References (6)
Core 6
Core References
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/534871/100/0/threaded
Exploit x_refsource_misc
http://packetstormsecurity.com/files/130838/Serendipity-CMS-2.0-Cross-Site-Scripting.html
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/03/14/1
Vendor Advisory x_refsource_confirm
http://blog.s9y.org/archives/263-Serendipity-2.0.1-released.html
Patch x_refsource_confirm
https://github.com/s9y/Serendipity/commit/a30886d3bb9d8eeb6698948864c77caaa982435d
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1031961
Scores
EPSS
0.0029
EPSS Percentile
52.0%
Details
CWE
CWE-79
Status
published
Products (1)
s9y/serendipity
< 2.0
Published
Mar 23, 2015
Tracked Since
Feb 18, 2026