Skip to content

Vendor

bludit vulnerabilities

46 published CVES affecting bludit, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
46
Critical
4
High
17
Medium
25
Low
0
Unscored
0
CISA KEV
0
Atom feed of bludit alerts

Products

Latest bludit CVEs

Newest publication first · page 1 of 2

  4. CVE-2026-72576 Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload

    Published
    MediumCVSS 5.4 EPSS 0.29%

    A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who...

  7. CVE-2026-41456 Bludit CMS Reflected XSS via Search Plugin

    Published
    MediumCVSS 5.1 EPSS 3.5%

    Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of us...

  8. CVE-2026-4420 Stored XSS via Page Creating functionality in Bludit

    Published
    MediumCVSS 5.1 EPSS 0.16%

    Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its page creating functionality. An authenticated attacker with page creation privileges (such as Author, Editor, or Administrator) can embed a malicious JavaScript payload in the tags field of a newly created article....

  10. CVE-2026-25100 Stored XSS via SVG File Upload in Bludit

    Published
    MediumCVSS 4.8 EPSS 0.20%

    Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload privileges (such as Author, Editor, or Administrator) can upload an SVG file containing a malicious payload, which is executed when a victim...

  11. CVE-2026-25101 Session Fixation in Bludit

    Published
    MediumCVSS 4.8 EPSS 0.37%

    Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID for a victim and later hijack the authenticated session. This issue was fixed in versio...

  12. CVE-2026-27741 Bludit <= 3.16.1 CSRF in Plugin and Theme Management Endpoints

    Published
    MediumCVSS 5.1 EPSS 0.17%

    Bludit version 3.16.1 contains a cross-site request forgery (CSRF) vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. The application does not implement anti-CSRF tokens or other request origin validation mechanisms for these administrative actions...

  13. CVE-2026-27742 Bludit <= 3.16.2 Stored XSS in Post Content

    Published
    MediumCVSS 5.1 EPSS 0.17%

    Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality. The application performs client-side sanitation of content input but does not enforce equivalent sanitation on the server side. An authenticated user can inject arb...

  15. CVE-2024-24554 Bludit - Insecure Token Generation

    Published
    MediumCVSS 6.0 EPSS 0.24%

    Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allows attackers to authenticate against the Bludit API.

  16. CVE-2024-24553 Bludit uses SHA1 as Password Hashing Algorithm

    Published
    MediumCVSS 5.9 EPSS 0.22%

    Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inherent speed of SHA-1. In addition, the salt that is computed by Bludit is generated with a non-cryptographically secure f...

  17. CVE-2024-24552 Bludit is Vulnerable to Session Fixation

    Published
    MediumCVSS 5.6 EPSS 0.39%

    A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into authorizing a session ID of their choosing.

  18. CVE-2024-24551 Bludit - Remote Code Execution (RCE) through Image API

    Published
    HighCVSS 8.9 EPSS 0.76%

    A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP files.

  19. CVE-2024-24550 Bludit - Remote Code Execution (RCE) through File API

    Published
    HighCVSS 8.9 EPSS 0.69%

    A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which leads to arbitrary code execution on the server. This vulnerability arises from improper handling of file uploads, enabl...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.