CVE-2004-2157: Cross-site scripting (XSS) vulnerability in Comment.php in Serendipity 0.7 beta1, and possibly other versio...

Security readout for executives and security teams

This CVE describes an old Serendipity blog flaw where attacker-controlled comment fields could inject arbitrary HTML and reportedly PHP code. Business urgency depends on whether any public site still runs Serendipity 0.7 beta1 or related pre-0.7-beta3 builds. Exposure is most plausible on legacy internet-facing Serendipity installations that allow public comments. The provided affected-product metadata is incomplete, so teams should verify actual Serendipity versions rather than relying on CPE data. Treat as a legacy exposure check, not a broad emergency. Escalate if an internet-facing Serendipity instance is found, especially if comments are enabled or the version is pre-0.7-beta3. Mitigation focus: Identify any Serendipity installations and their exact versions.; Prioritize upgrades away from Serendipity 0.7 beta1 and pre-0.7-beta3 builds.; Check current vendor or project guidance for supported remediation..

Prepared

Jun 29, 2026, 19:30 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.