PT-2025-51970 · Unknown · Serendipity

Mirabbas Ağalarov · Published 2025-12-17 · Updated 2025-12-24 · CVE-2023-53932

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Serendipity version 2.4.0

Description An authenticated user can inject malicious scripts through blog entry creation. An attacker can create blog entries with JavaScript payloads that execute when other users view the compromised post. This is a stored cross-site scripting issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-53932

Affected Products

Serendipity

References · 9

• 🔥 https://vulncheck.com/advisories/serendipity-stored-cross-site-scripting-via-admin-entry-creation · Exploit
• 🔥 https://exploit-db.com/exploits/51373 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53932 · Security Note
• https://osv.dev/vulnerability/CVE-2023-53932 · Vendor Advisory
• https://docs.s9y.org · Note
• https://t.me/cveNotify/146774 · Telegram Post
• https://twitter.com/CVEnew/status/2002487774000398648 · Twitter Post
• https://t.me/CVEtracker/40088 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2001641742957760921 · Twitter Post