CVE-2019-11870

Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.

• CWE-79

• http://www.openwall.com/lists/oss-security/2019/05/10/1Mailing List, Third Party Advisory
• https://blog.s9y.org/archives/282-Serendipity-2.1.5-released.htmlRelease Notes, Vendor Advisory
• https://github.com/s9y/Serendipity/issues/598Third Party Advisory
• https://www.openwall.com/lists/oss-security/2019/05/03/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/05/10/1Mailing List, Third Party Advisory
• https://blog.s9y.org/archives/282-Serendipity-2.1.5-released.htmlRelease Notes, Vendor Advisory
• https://github.com/s9y/Serendipity/issues/598Third Party Advisory
• https://www.openwall.com/lists/oss-security/2019/05/03/3Mailing List, Third Party Advisory

Published

May 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1186An elevation of privilege vulnerability exists in the way th…7
• CVE-2019-11862The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows …8.4
• CVE-2019-11867Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015…5.5
• CVE-2019-11868See.sys, up to version 4.25, in SoftEther VPN Server version…7.8
• CVE-2019-11869The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS …
• CVE-2019-1187A denial of service vulnerability exists when the XmlLite ru…5.5
• CVE-2019-11871The Custom Field Suite plugin before 2.5.15 for WordPress ha…
• CVE-2019-11872The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress …8.8
• CVE-2019-11873wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tl…9.8
• CVE-2019-11875In AutomateAppCore.dll in Blue Prism Robotic Process Automat…
• CVE-2019-11876In PrestaShop 1.7.5.2, the shop_country parameter in the ins…
• CVE-2019-11877XSS on the PIX-Link Repeater/Router LV-WR09 with firmware v2…