CVE-2014-9432: s9y Serendipity

Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY_STRING to serendipity/index.php.

Affected products

• s9y Serendipity: up to and including 2.0

Published 2014-12-31. Last modified 2026-06-17.