Read the docs
TI-2010-02830 Aliases CVE-2010-2957GHSA-6hj3-wg93-qcgm

Cross-site scripting (XSS) vulnerability in Serendipity before 1.5.4, when "Remember me"…

Priority LOW 15CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in Serendipity before 1.5.4, when "Remember me" logins are enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Why it matters now

EPSS 0.01104 65th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 54

CPEVersionsRoleVendor
cpe:2.3:a:s9y:serendipity:*:*:*:*:*:*:*:*up to 1.5.3Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.3:*:*:*:*:*:*:*0.3Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.4:*:*:*:*:*:*:*0.4Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.5:*:*:*:*:*:*:*0.5Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.5:pl1:*:*:*:*:*:*0.5 pl1Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.6:*:*:*:*:*:*:*0.6Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.6:pl1:*:*:*:*:*:*0.6 pl1Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.6:pl2:*:*:*:*:*:*0.6 pl2Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.6:pl3:*:*:*:*:*:*0.6 pl3Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.6:rc1:*:*:*:*:*:*0.6 rc1Vulnerables9y
  • cpe:2.3:a:s9y:serendipity:*:*:*:*:*:*:*:* Versions up to 1.5.3 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.5:pl1:*:*:*:*:*:* Versions 0.5 pl1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.6:pl1:*:*:*:*:*:* Versions 0.6 pl1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.6:pl2:*:*:*:*:*:* Versions 0.6 pl2 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.6:pl3:*:*:*:*:*:* Versions 0.6 pl3 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.6:rc1:*:*:*:*:*:* Versions 0.6 rc1 Vulnerable ·s9y
Show 44 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:s9y:serendipity:0.6:rc2:*:*:*:*:*:*0.6 rc2Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.7:*:*:*:*:*:*:*0.7Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.7:beta1:*:*:*:*:*:*0.7 beta1Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.7:beta2:*:*:*:*:*:*0.7 beta2Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.7:beta3:*:*:*:*:*:*0.7 beta3Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.7:beta4:*:*:*:*:*:*0.7 beta4Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.7:rc1:*:*:*:*:*:*0.7 rc1Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.7.1:*:*:*:*:*:*:*0.7.1Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.8:*:*:*:*:*:*:*0.8Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.8:beta5:*:*:*:*:*:*0.8 beta5Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.8:beta6:*:*:*:*:*:*0.8 beta6Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.8:beta6_snapshot:*:*:*:*:*:*0.8 beta6_snapshotVulnerables9y
cpe:2.3:a:s9y:serendipity:0.8.1:*:*:*:*:*:*:*0.8.1Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.8.2:*:*:*:*:*:*:*0.8.2Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.8.3:*:*:*:*:*:*:*0.8.3Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.8.4:*:*:*:*:*:*:*0.8.4Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.8.5:*:*:*:*:*:*:*0.8.5Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.9:*:*:*:*:*:*:*0.9Vulnerables9y
cpe:2.3:a:s9y:serendipity:0.9.1:*:*:*:*:*:*:*0.9.1Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.0:*:*:*:*:*:*:*1.0Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.0:beta1:*:*:*:*:*:*1.0 beta1Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.0:beta2:*:*:*:*:*:*1.0 beta2Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.0:beta3:*:*:*:*:*:*1.0 beta3Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.0.1:*:*:*:*:*:*:*1.0.1Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.0.2:*:*:*:*:*:*:*1.0.2Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.0.3:*:*:*:*:*:*:*1.0.3Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.0.4:*:*:*:*:*:*:*1.0.4Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.1:*:*:*:*:*:*:*1.1Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.1:beta1:*:*:*:*:*:*1.1 beta1Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.1.1:*:*:*:*:*:*:*1.1.1Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.1.2:*:*:*:*:*:*:*1.1.2Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.1.3:*:*:*:*:*:*:*1.1.3Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.1.4:*:*:*:*:*:*:*1.1.4Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.2:*:*:*:*:*:*:*1.2Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.2:beta5:*:*:*:*:*:*1.2 beta5Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.2.1:*:*:*:*:*:*:*1.2.1Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.3:*:*:*:*:*:*:*1.3Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.3.1:*:*:*:*:*:*:*1.3.1Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.4:*:*:*:*:*:*:*1.4Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.4.1:*:*:*:*:*:*:*1.4.1Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.5:*:*:*:*:*:*:*1.5Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.5:beta1:*:*:*:*:*:*1.5 beta1Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.5.1:*:*:*:*:*:*:*1.5.1Vulnerables9y
cpe:2.3:a:s9y:serendipity:1.5.2:*:*:*:*:*:*:*1.5.2Vulnerables9y
  • cpe:2.3:a:s9y:serendipity:0.6:rc2:*:*:*:*:*:* Versions 0.6 rc2 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.7:beta1:*:*:*:*:*:* Versions 0.7 beta1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.7:beta2:*:*:*:*:*:* Versions 0.7 beta2 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.7:beta3:*:*:*:*:*:* Versions 0.7 beta3 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.7:beta4:*:*:*:*:*:* Versions 0.7 beta4 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.7:rc1:*:*:*:*:*:* Versions 0.7 rc1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.8:*:*:*:*:*:*:* Versions 0.8 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.8:beta5:*:*:*:*:*:* Versions 0.8 beta5 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.8:beta6:*:*:*:*:*:* Versions 0.8 beta6 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.8:beta6_snapshot:*:*:*:*:*:* Versions 0.8 beta6_snapshot Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.8.1:*:*:*:*:*:*:* Versions 0.8.1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.8.2:*:*:*:*:*:*:* Versions 0.8.2 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.8.3:*:*:*:*:*:*:* Versions 0.8.3 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.8.4:*:*:*:*:*:*:* Versions 0.8.4 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.8.5:*:*:*:*:*:*:* Versions 0.8.5 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.9:*:*:*:*:*:*:* Versions 0.9 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:0.9.1:*:*:*:*:*:*:* Versions 0.9.1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.0:beta1:*:*:*:*:*:* Versions 1.0 beta1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.0:beta2:*:*:*:*:*:* Versions 1.0 beta2 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.0:beta3:*:*:*:*:*:* Versions 1.0 beta3 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.1:beta1:*:*:*:*:*:* Versions 1.1 beta1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.2:beta5:*:*:*:*:*:* Versions 1.2 beta5 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.5:beta1:*:*:*:*:*:* Versions 1.5 beta1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·s9y
  • cpe:2.3:a:s9y:serendipity:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·s9y

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-2957
  2. 2026-10-03 Alias added: GHSA-6hj3-wg93-qcgm

References

Exploit 1

Patch 1

Other 2

  • TI-2023-30216 Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload CVSS 4.0HIGH 8.7
  • TI-2024-38379 Serendipity 2.5.0 Remote Code Execution via Authenticated Media Upload CVSS 4.0HIGH 8.6
  • TI-2026-28827 Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST CVSS 3.1HIGH 7.2
  • TI-2026-28819 Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain CVSS 3.1MEDIUM 6.9
  • TI-2023-30215 Serendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry Creation CVSS 4.0MEDIUM 5.1
  • TI-2011-00987 Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5… CVSS 3.1CRITICAL 9.8
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences