peter bassill · operator
$ cve CVE-2004-1620 JSON

CVE-2004-1620 EXPLOIT

5.0
MEDIUM · CVSS 2.0 · EPSS 8.1% (pctl 95)

Patch early

A public exploit exists.

Description

CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the url parameter in (1) index.php and (2) exit.php, or (3) the HTTP Referer field in comment.php.

Scoring

CVSS5.0 (MEDIUM, v2.0)
VectorAV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS8.14% — more likely to be exploited than 95% of all CVEs
On CISA KEVno
Public exploityes
Published2004-10-21
Last modified2026-06-16

Affected (1)

VendorProduct
s9yserendipity

Public exploits

SourceTitleDate
exploit-dbS9Y Serendipity 0.x - 'exit.php' HTTP Response Splitting2004-10-21

References

→ the Explorer  ·  watch your stack  ·  NVD