CVE-2008-0124

Published: Feb 28, 2008Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3-beta1 allows remote authenticated users to inject arbitrary web script or HTML via (1) the "Real name" field in Personal Settings, which is presented to readers of articles; or (2) a file upload, as demonstrated by a .htm, .html, or .js file.

Affected (34)

Products: S9y: Serendipity

S9y

1 product

Serendipity

Configuration A

34 vulnerable

Vulnerable Software	Affected Versions
S9y Serendipity	Version 0.3
S9y Serendipity	Version 0.4
S9y Serendipity	Version 0.5
S9y Serendipity	Version 0.5_pl1
S9y Serendipity	Version 0.6
S9y Serendipity	Version 0.6_pl1
S9y Serendipity	Version 0.6_pl2
S9y Serendipity	Version 0.6_pl3
S9y Serendipity	Version 0.6_rc1
S9y Serendipity	Version 0.6_rc2
S9y Serendipity	Version 0.7.1
S9y Serendipity	Version 0.7
S9y Serendipity	Version 0.7_beta1
S9y Serendipity	Version 0.7_beta2
S9y Serendipity	Version 0.7_beta3
S9y Serendipity	Version 0.7_beta4
S9y Serendipity	Version 0.7_rc1
S9y Serendipity	Version 0.8.1
S9y Serendipity	Version 0.8.2
S9y Serendipity	Version 0.8
S9y Serendipity	Version 0.8_beta5
S9y Serendipity	Version 0.8_beta6
S9y Serendipity	Version 0.8_beta_6_snapshot
S9y Serendipity	Version 0.9.1
S9y Serendipity	Version 1.0.3
S9y Serendipity	Version 1.0.4
S9y Serendipity	Version 1.0_beta2
S9y Serendipity	Version 1.0_beta3
S9y Serendipity	Version 1.1.1
S9y Serendipity	Version 1.1.3
S9y Serendipity	Version 1.1.4
S9y Serendipity	Version 1.2.1
S9y Serendipity	Version 1.2
S9y Serendipity	Version 1.2__beta5