CVE-2011-1134: s9y Serendipity

Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days.

Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager.

Affected products

• s9y Serendipity: before 1.5.5 (fixed in 1.5.5)

Published 2019-11-05. Last modified 2026-06-16.