Hutsbotnet

**Name of the Vulnerable Software and Affected Versions** Serendipity versions 2.3.5 through 2.6.0 **Description** A reflected cross-site scripting issue exists in the search clean-URL route '/search/<term>'. Within the `serveSearch()` function located in include/functions routing.inc.php, the sanitization process executes `urldecode()` after HTML-encoding. This sequence allows a URL-encoded HTML payload to bypass `strip tags()` and `htmlspecialchars()`, which is then decoded back into active HTML on the page. An attacker can use a crafted search link to execute arbitrary JavaScript in the browser of a victim. **Recommendations** Update Serendipity to version 2.6.1.