S9y vulnerabilities
We track 4 vulnerabilities in S9y products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 13, 2026.
Latest S9y vulnerabilities
- 8.5 High severity
Serendipity: Server-Side Request Forgery
Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can b
- 8.8 High severity
Serendipity: Missing Critical Step in Authentication
Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with
- 7.2 High severity
Serendipity: Improper Neutralization of CRLF Sequences in HTTP Headers
Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without validation, and the existing sanitization f
- 8.8 High severity
Serendipity: Unrestricted Upload of File with Dangerous Type
Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary