Advisories · Technology
Bludit.
Every CVE that names Bludit among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.4 Medium
Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload
- Bludit
- Cross-site scripting (XSS)
- CVSS 7.1 High
Bludit's persistent authentication tokens not revoked upon account disablement
- bludit
- Authentication bypass
- CWE-212
- CVSS 8.8 High
Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions
- bludit
- Broken access control
- Authentication bypass
- CVSS 5.1 Medium
Bludit CMS Reflected XSS via Search Plugin
- bludit
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored XSS via Page Creating functionality in Bludit
- Bludit
- Cross-site scripting (XSS)
- CVSS 8.7 High
Remote Code Execution via Unrestricted File Upload in Bludit
- Bludit
- Unrestricted file upload
- CVSS 4.8 Medium
Stored XSS via SVG File Upload in Bludit
- Bludit
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Session Fixation in Bludit
- Bludit
- Authentication bypass
- CVSS 5.1 Medium
Bludit <= 3.16.1 CSRF in Plugin and Theme Management Endpoints
- Bludit
- Cross-site request forgery (CSRF)
- CVSS 5.1 Medium
Bludit <= 3.16.2 Stored XSS in Post Content
- Bludit
- Cross-site scripting (XSS)
- CVSS 6.0 Medium
Bludit - Insecure Token Generation
- Bludit
- Authentication bypass
- Weak cryptography or TLS
- CVSS 5.9 Medium
Bludit uses SHA1 as Password Hashing Algorithm
- Bludit
- Weak cryptography or TLS
- CVSS 5.6 Medium
Bludit is Vulnerable to Session Fixation
- Bludit
- Authentication bypass
- CVSS 8.9 High
Bludit - Remote Code Execution (RCE) through Image API
- Bludit
- Command injection
- Unrestricted file upload
- CVSS 8.9 High
Bludit - Remote Code Execution (RCE) through File API
- Bludit
- Command injection
- Unrestricted file upload
- CVSS 3.5 Low
Bludit New Content Module new-content cross site scripting
- Bludit
- Cross-site scripting (XSS)