Bludit vulnerabilities

Products

• Bludit 46
• Cms 3

Newest

• bludit cms Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints CVE-2026-93366 5.3 MediumSeptember 25, 2026
• bludit cms Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint CVE-2026-93365 7.1 HighSeptember 25, 2026
• bludit cms Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit() CVE-2026-93364 5.3 MediumSeptember 25, 2026
• bludit Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload CVE-2026-72576 5.4 MediumAugust 10, 2026
• bludit Bludit's persistent authentication tokens not revoked upon account disablement CVE-2026-46657 7.1 HighJune 8, 2026
• bludit Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions CVE-2026-46656 8.8 HighJune 8, 2026
• bludit Bludit CMS Reflected XSS via Search Plugin CVE-2026-41456 Public exploit 5.1 MediumApril 21, 2026
• bludit Stored XSS via Page Creating functionality in Bludit CVE-2026-4420 5.1 MediumApril 7, 2026
• bludit Remote Code Execution via Unrestricted File Upload in Bludit CVE-2026-25099 Public exploit 8.7 HighMarch 27, 2026
• bludit Stored XSS via SVG File Upload in Bludit CVE-2026-25100 4.8 MediumMarch 27, 2026
• bludit Session Fixation in Bludit CVE-2026-25101 4.8 MediumMarch 27, 2026
• bludit Bludit <= 3.16.1 CSRF in Plugin and Theme Management Endpoints CVE-2026-27741 5.1 MediumFebruary 23, 2026
• bludit Bludit <= 3.16.2 Stored XSS in Post Content CVE-2026-27742 5.1 MediumFebruary 23, 2026
• bludit backup plugin, bludit +1 more Bludit < 3.13.0 Authenticated Arbitrary File Download via Backup Plugin CVE-2023-53907 7.1 HighDecember 17, 2025
• bludit Bludit - Insecure Token Generation CVE-2024-24554 6.0 MediumJune 24, 2024
• bludit Bludit uses SHA1 as Password Hashing Algorithm CVE-2024-24553 5.9 MediumJune 24, 2024
• bludit Bludit is Vulnerable to Session Fixation CVE-2024-24552 5.6 MediumJune 24, 2024
• bludit Bludit - Remote Code Execution (RCE) through Image API CVE-2024-24551 8.9 HighJune 24, 2024
• bludit Bludit - Remote Code Execution (RCE) through File API CVE-2024-24550 8.9 HighJune 24, 2024
• bludit Cross Site Scripting (XSS) vulnerability in Bludit CMS version 3.15, allows remote attackers to... CVE-2024-25297 4.8 MediumFebruary 17, 2024
• bludit Cross Site Scripting Vulnerability in BluditCMS v.3.14.1 allows attackers to execute arbitrary... CVE-2023-24675 4.8 MediumSeptember 1, 2023
• bludit Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate... CVE-2023-24674 7.8 HighSeptember 1, 2023
• bludit Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. CVE-2020-20210 8.8 HighJune 26, 2023
• bludit Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component ... CVE-2023-34845 Public exploitDisputed 5.4 MediumJune 16, 2023
• bludit Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. CVE-2023-31698 Public exploitDisputed 5.4 MediumMay 17, 2023
• bludit An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password... CVE-2023-31572 8.8 HighMay 16, 2023
• bludit An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers... CVE-2020-19228 7.2 HighMay 11, 2022
• bludit Bludit New Content Module new-content cross site scripting CVE-2022-1590 3.5 LowMay 5, 2022
• bludit A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in... CVE-2021-45745 Public exploit 5.4 MediumJanuary 6, 2022
• bludit A Stored Cross Site Scripting (XSS) vulnerability exists in bludit 3.13.1 via the TAGS section in... CVE-2021-45744 Public exploit 5.4 MediumJanuary 6, 2022
• bludit Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login. CVE-2021-35323 Public exploit 6.1 MediumOctober 19, 2021
• bludit bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the ... CVE-2020-20495 9.1 CriticalAugust 31, 2021
• bludit Unrestricted File Upload in Bludit v3.8.1 allows remote attackers to execute arbitrary code by... CVE-2020-18879 9.8 CriticalAugust 20, 2021
• bludit A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute... CVE-2021-25808 7.8 HighJuly 23, 2021
• bludit A file upload vulnerability was discovered in the file path /bl-plugins/backup/plugin.php on... CVE-2020-23765 7.2 HighMay 21, 2021
• bludit Bludit v3.8.1 is affected by directory traversal. Remote attackers are able to delete arbitrary... CVE-2020-18190 9.1 CriticalOctober 2, 2020
• bludit Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal... CVE-2020-15026 4.9 MediumJune 24, 2020
• bludit Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo... CVE-2020-15006 5.4 MediumJune 24, 2020
• bludit showAlert() in the administration panel in Bludit 3.12.0 allows XSS. CVE-2020-13889 Public exploit 5.4 MediumJune 6, 2020
• bludit ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users... CVE-2020-8811 4.3 MediumFebruary 7, 2020
• bludit ** DISPUTED ** Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the... CVE-2020-8812 Disputed 5.4 MediumFebruary 7, 2020
• bludit bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection... CVE-2019-17240 Public exploit EPSS 40.7% 3.7 LowOctober 6, 2019
• bludit In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -... CVE-2019-16334 4.8 MediumSeptember 15, 2019
• bludit Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code... CVE-2019-16113 Public exploit EPSS 78.1% 8.8 HighSeptember 8, 2019
• bludit Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account,... CVE-2019-12742 8.8 HighJune 5, 2019
• bludit Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php... CVE-2019-12548 8.8 HighJune 3, 2019
• bludit bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in... CVE-2018-1000811 Public exploit EPSS 47.6% 8.8 HighDecember 20, 2018
• bludit Bludit 2.3.4 allows XSS via a user name. CVE-2018-16313 6.1 MediumSeptember 1, 2018
• bludit In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and... CVE-2017-16636 5.4 MediumNovember 6, 2017