CVE-2016-10082 Serendipity Multiple File Include and Cross-Site Scripting Vulnerabilities

Serendipity is a PHP-powered weblog application which gives the user a way to maintain an online diary, weblog or a complete homepage.

Serendipity contains the following vulnerabilities:
CVE-2016-10082: The include/functions_installer.inc.php source file is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include() call in the bundled-libs/serendipity_generateFTPChecksums.php file.
CVE-2016-9681: Multiple cross-site scripting vulnerabilities in the creation of new category page and in the creation of base directory page.

Affected Versions:
Serendipity versions prior to 2.0.5

Depending on the vulnerability being exploited, a remote attacker could execute arbitrary code by including malicious files or conduct cross-site scripting attacks against a targeted user.

Customers are advised to install Serendipity 2.0.5 or later versions to remediate this vulnerability.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

Serendipity 2.0.5 or later