Read the docs
TI-2005-01373 Aliases CVE-2005-1451GHSA-7q82-vwr5-4pv4

The media manager in Serendipity before 0.8 allows remote attackers to upload and execute…

Priority LOW 36Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The media manager in Serendipity before 0.8 allows remote attackers to upload and execute arbitrary (1) .php or (2) .shtml files.

Why it matters now

EPSS 0.01572 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:s9y:serendipity:0.3:*:*:*:*:*:*:*0.3Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.4:*:*:*:*:*:*:*0.4Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.5_pl1:*:*:*:*:*:*:*0.5_pl1Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.6_pl3:*:*:*:*:*:*:*0.6_pl3Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.7:*:*:*:*:*:*:*0.7Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.7.1:*:*:*:*:*:*:*0.7.1Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.7_beta1:*:*:*:*:*:*:*0.7_beta1Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.7_beta2:*:*:*:*:*:*:*0.7_beta2Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.7_beta3:*:*:*:*:*:*:*0.7_beta3Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.7_beta4:*:*:*:*:*:*:*0.7_beta4Vulnerables9y
  • cpe:2.3:a:s9y:serendipity:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.5_pl1:*:*:*:*:*:*:* Versions 0.5_pl1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.6_pl3:*:*:*:*:*:*:* Versions 0.6_pl3 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.7_beta1:*:*:*:*:*:*:* Versions 0.7_beta1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.7_beta2:*:*:*:*:*:*:* Versions 0.7_beta2 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.7_beta3:*:*:*:*:*:*:* Versions 0.7_beta3 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.7_beta4:*:*:*:*:*:*:* Versions 0.7_beta4 Vulnerable ·s9y
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:s9y:serendipity:0.7_rc1:*:*:*:*:*:*:*0.7_rc1Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.8_beta_5:*:*:*:*:*:*:*0.8_beta_5Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.8_beta_6:*:*:*:*:*:*:*0.8_beta_6Vulnerables9y
  • cpe:2.3:a:s9y:serendipity:0.7_rc1:*:*:*:*:*:*:* Versions 0.7_rc1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.8_beta_5:*:*:*:*:*:*:* Versions 0.8_beta_5 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.8_beta_6:*:*:*:*:*:*:* Versions 0.8_beta_6 Vulnerable ·s9y

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-1451
  2. 2026-10-03 Alias added: GHSA-7q82-vwr5-4pv4

References

Patch 1

Other 1

  • TI-2023-30216 Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload CVSS 4.0HIGH 8.7
  • TI-2024-38379 Serendipity 2.5.0 Remote Code Execution via Authenticated Media Upload CVSS 4.0HIGH 8.6
  • TI-2026-28827 Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST CVSS 3.1HIGH 7.2
  • TI-2026-28819 Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain CVSS 3.1MEDIUM 6.9
  • TI-2023-30215 Serendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry Creation CVSS 4.0MEDIUM 5.1
  • TI-2011-00987 Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5… CVSS 3.1CRITICAL 9.8
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences