Every CVESearch/Get API key

CVE-2019-16113

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code...

8.8 HighPublic exploit

CVE-2019-16113 is a high vulnerability (CVSS 8.8) in Bludit, published September 8, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 78.1%, the 99th percentile. No source names a fixed version.

What does this mean?
Severity
8.8 HighCVSS 3.1, NVD
Exploit chance
78.1%EPSS, 99th percentile
Exploitation
None known12 public exploits
Fixed in
No fix listedNo source names one

Description

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

78.1%Up 34.5 points since Apr 14, 2021
90%50%10%1%

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitBludit Directory Traversal Image File Upload Vulnerability2019-09-07
Exploit-DBBludit - Directory Traversal Image File Upload (Metasploit)2019-11-20
PoC in GitHubynots0ups/CVE-2019-161132020-06-03
PoC in GitHubcybervaca/CVE-2019-161132020-06-04
Exploit-DBBludit 3.9.12 - Directory Traversal2020-06-09
PoC in GitHubhg8/CVE-2019-16113-PoC2020-06-09
PoC in GitHubKenun99/CVE-2019-16113-Dockerfile2020-07-03
PoC in GitHubdldygnl/CVE-2019-161132020-07-17
Exploit-DBBludit 3.9.2 - Directory Traversal2020-07-26
PoC in GitHubm4rm0k/CVE-2019-161132020-10-07
PoC in GitHubDXY0411/CVE-2019-161132021-02-05
PoC in GitHubmind2hex/CVE-2019-16113-Bludit-3.9.2-RCE2024-03-28

What each source reports

NVD Score used8.8

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.

Record
CVE-2019-16113
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-22
Updated
2026-11-02
CVE ListNo score

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.

Record
CVE-2019-16113
Updated
2026-11-02
EUVDEUVD-2019-6954No score

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.

Record
EUVD-2019-6954
Updated
2026-11-03
GitHub AdvisoriesGHSA-ch69-hjrw-4hf38.8

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code...

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.

Record
GHSA-ch69-hjrw-4hf3
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22, CWE-94
Updated
2026-11-02
OSV8.8

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.

Record
CVE-2019-16113
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

History

History
RecordedChangedSources
exploits, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open