CVE-2010-1916: s9y Serendipity

High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days.

The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted backend_config_secret_key_location and backend_config_hash parameters that are used in a SHA1 hash of a shared secret that can be known or externally influenced, which are not properly handled by the "Deprecated config passing" feature; or (2) crafted backend_data and backend_data[key_location] variables, which are not properly handled by the xinha_read_passed_data function. NOTE: this can be leveraged to upload and possibly execute arbitrary files via config.inc.php in the ImageManager plugin.

Affected products

• s9y Serendipity: version 0.3 only; version 0.4 only; version 0.5 only; version 0.6 only; version 0.7 only; version 0.7.1 only; …
• Xinha Wysiwyg Editor: version 0.9 only; version 0.91 only; version 0.92 only; version 0.93 only; version 0.94 only; version 0.95 only; …

Published 2010-05-12. Last modified 2026-06-16.