CVE-2016-9752: s9y Serendipity

High severity, CVSS 8.6. EPSS: 1.1% chance of exploitation in the next 30 days.

In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.

Affected products

• s9y Serendipity: up to and including 2.0.4

Published 2016-12-01. Last modified 2026-06-17.