CVE-2016-9752

HIGH 8.6CVE-2016-9752 · Published 01/12/2016 · updated 17/06/2026

In short

CVE-2016-9752 is a HIGH (CVSS 8.6) vulnerability affecting serendipity (s9y).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 64.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
serendipity s9y	`≤ 2.0.4`	No fix yet

Description

In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.

References

securityfocus.com/bid/94622
blog.s9y.org/archives/271-Serendipity-2.0.5-and-2.1-beta3-released.html · Vendor Advisory
s9y/Serendipity commit fbdd50a · Issue Tracking

More vulnerabilities in serendipity

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

serendipity

s9y

≤ 2.0.4

No fix yet

More vulnerabilities in serendipity

See all →