{"id":"CVE-2023-53933","state":"PUBLISHED","title":"Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload","description":"Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.","publishedAt":"2025-12-17T22:44:59.632Z","updatedAt":"2026-04-07T14:07:53.832Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["s9y Serendipity"],"affected":[{"vendor":"s9y","product":"Serendipity","versions":[{"version":"2.4.0","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/51372","https://docs.s9y.org/","https://www.vulncheck.com/advisories/serendipity-authenticated-remote-code-execution-via-file-upload"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/53xxx/CVE-2023-53933.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53933","state":"PUBLISHED","datePublished":"2025-12-17T22:44:59.632Z","dateUpdated":"2026-04-07T14:07:53.832Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-12-16T19:22:09.997Z"},"containers":{"cna":{"title":"Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload","descriptions":[{"lang":"en","value":"Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server."}],"affected":[{"vendor":"s9y","product":"Serendipity","versions":[{"version":"2.4.0","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/51372","name":"ExploitDB-51372","tags":["exploit"]},{"url":"https://docs.s9y.org/","name":"Official Product Homepage","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/serendipity-authenticated-remote-code-execution-via-file-upload","name":"VulnCheck Advisory: Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","lang":"en","description":"Unrestricted Upload of File with Dangerous Type","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-04-07T14:07:53.832Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:s9y:serendipity:2.4.0:beta1:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Mirabbas Ağalarov","type":"finder"}],"x_generator":{"engine":"vulncheck"},"datePublic":"2023-04-20T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.exploit-db.com/exploits/51372","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-18T18:47:45.289505Z","id":"CVE-2023-53933","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-18T18:54:23.264Z"}}]}}}