CVE-2015-2289: s9y Serendipity

Low severity, CVSS 3.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, when creating a new category.

Affected products

• s9y Serendipity: up to and including 2.0

Published 2015-03-23. Last modified 2026-06-17.