Cross-site scripting (XSS) vulnerability in the BBCode plugin for Serendipity before 0.8…
Priority LOW 33Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Cross-site scripting (XSS) vulnerability in the BBCode plugin for Serendipity before 0.8 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Why it matters now
EPSS 0.0134 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:s9y:serendipity:0.7:*:*:*:*:*:*:* | 0.7 | Vulnerable | s9y |
| cpe:2.3:a:s9y:serendipity:0.7.1:*:*:*:*:*:*:* | 0.7.1 | Vulnerable | s9y |
| cpe:2.3:a:s9y:serendipity:0.7_beta1:*:*:*:*:*:*:* | 0.7_beta1 | Vulnerable | s9y |
| cpe:2.3:a:s9y:serendipity:0.7_beta2:*:*:*:*:*:*:* | 0.7_beta2 | Vulnerable | s9y |
| cpe:2.3:a:s9y:serendipity:0.7_beta3:*:*:*:*:*:*:* | 0.7_beta3 | Vulnerable | s9y |
| cpe:2.3:a:s9y:serendipity:0.7_beta4:*:*:*:*:*:*:* | 0.7_beta4 | Vulnerable | s9y |
| cpe:2.3:a:s9y:serendipity:0.7_rc1:*:*:*:*:*:*:* | 0.7_rc1 | Vulnerable | s9y |
| cpe:2.3:a:s9y:serendipity:0.8_beta5:*:*:*:*:*:*:* | 0.8_beta5 | Vulnerable | s9y |
| cpe:2.3:a:s9y:serendipity:0.8_beta6:*:*:*:*:*:*:* | 0.8_beta6 | Vulnerable | s9y |
- cpe:2.3:a:s9y:serendipity:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·s9y
- cpe:2.3:a:s9y:serendipity:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·s9y
- cpe:2.3:a:s9y:serendipity:0.7_beta1:*:*:*:*:*:*:* Versions 0.7_beta1 Vulnerable ·s9y
- cpe:2.3:a:s9y:serendipity:0.7_beta2:*:*:*:*:*:*:* Versions 0.7_beta2 Vulnerable ·s9y
- cpe:2.3:a:s9y:serendipity:0.7_beta3:*:*:*:*:*:*:* Versions 0.7_beta3 Vulnerable ·s9y
- cpe:2.3:a:s9y:serendipity:0.7_beta4:*:*:*:*:*:*:* Versions 0.7_beta4 Vulnerable ·s9y
- cpe:2.3:a:s9y:serendipity:0.7_rc1:*:*:*:*:*:*:* Versions 0.7_rc1 Vulnerable ·s9y
- cpe:2.3:a:s9y:serendipity:0.8_beta5:*:*:*:*:*:*:* Versions 0.8_beta5 Vulnerable ·s9y
- cpe:2.3:a:s9y:serendipity:0.8_beta6:*:*:*:*:*:*:* Versions 0.8_beta6 Vulnerable ·s9y
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2005-1448
- 2026-10-03 Alias added: GHSA-fjw5-crgv-6q7v
References
More s9y Serendipity vulnerabilities
- TI-2023-30216 Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload CVSS 4.0HIGH 8.7
- TI-2024-38379 Serendipity 2.5.0 Remote Code Execution via Authenticated Media Upload CVSS 4.0HIGH 8.6
- TI-2026-28827 Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST CVSS 3.1HIGH 7.2
- TI-2026-28819 Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain CVSS 3.1MEDIUM 6.9
- TI-2023-30215 Serendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry Creation CVSS 4.0MEDIUM 5.1
- TI-2011-00987 Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2005-1448 · CVE Program
- CVE-2005-1448 · NVD
- FIRST EPSS
- GHSA-fjw5-crgv-6q7v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences