1.7.6

DATE	CVE	VULNERABILITY TITLE	RISK
2015-09-16	CVE-2015-6969	Cross-site Scripting vulnerability in S9Y Serendipity Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link. network s9y CWE-79	4.3
2015-09-16	CVE-2015-6968	Unspecified vulnerability in S9Y Serendipity Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht or (2) .phtml extension. network low complexity s9y	6.5
2015-09-15	CVE-2015-6943	SQL Injection vulnerability in S9Y Serendipity SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote administrators to execute arbitrary SQL commands via the serendipity[id] parameter to serendipity_admin.php. network s9y CWE-89	6.0
2015-03-23	CVE-2015-2289	Cross-site Scripting vulnerability in S9Y Serendipity Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, when creating a new category. network s9y CWE-79	3.5