CVE-2026-72576 | Medium | 5.4 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript… |
CVE-2026-46657 | High | 7.1 | 2026-06-08 | Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain… |
CVE-2026-46656 | High | 8.8 | 2026-06-08 | Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the correspondi… |
CVE-2026-41456 | | | 2026-04-21 | Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject… |
CVE-2026-4420 | Medium | 5.4 | 2026-04-07 | Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its page creating functionality. An authenticated attacker with page creation privileges (such as… |
CVE-2026-25101 | Critical | 9.8 | 2026-03-27 | Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enable… |
CVE-2026-25100 | Medium | 5.4 | 2026-03-27 | Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload privileges (such as… |
CVE-2026-25099 | High | 8.8 | 2026-03-27 | Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be ex… |
CVE-2026-27742 | Medium | 5.4 | 2026-02-23 | Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality. The application performs client-side sanita… |
CVE-2026-27741 | Medium | 4.3 | 2026-02-23 | Bludit version 3.16.1 contains a cross-site request forgery (CSRF) vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. The appli… |
CVE-2023-53907 | Medium | 6.5 | 2025-12-17 | Bludit versions before 3.13.1 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to access arbitrary files… |
CVE-2024-24554 | High | 8.2 | 2024-06-24 | Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allow… |
CVE-2024-24553 | High | 7.5 | 2024-06-24 | Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inh… |
CVE-2024-24552 | High | 8.8 | 2024-06-24 | A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into a… |
CVE-2024-24551 | High | 8.8 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability ar… |
CVE-2024-24550 | High | 8.1 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which… |
CVE-2024-25297 | Medium | 4.8 | 2024-02-17 | Cross Site Scripting (XSS) vulnerability in Bludit CMS version 3.15, allows remote attackers to execute arbitrary code and obtain sensitive information via edi… |
CVE-2023-24675 | Medium | 4.8 | 2023-09-01 | Cross Site Scripting Vulnerability in BluditCMS v.3.14.1 allows attackers to execute arbitrary code via the Categories Friendly URL. |
CVE-2023-24674 | High | 7.8 | 2023-09-01 | Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin parameter. |
CVE-2020-20210 | High | 8.8 | 2023-06-26 | Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. |
CVE-2023-34845 | Medium | 5.4 | 2023-06-16 | Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to exe… |
CVE-2023-31698 | Medium | 5.4 | 2023-05-17 | Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that users are trusted by th… |
CVE-2023-31572 | High | 8.8 | 2023-05-16 | An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privileges via a crafted request. |
CVE-2020-19228 | High | 7.2 | 2022-05-11 | An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary files. |
CVE-2022-1590 | Low | 3.5 | 2022-05-05 | A vulnerability was found in Bludit 3.13.1. It has been declared as problematic. This vulnerability affects the endpoint /admin/new-content of the New Content… |
CVE-2021-45745 | Medium | 5.4 | 2022-01-06 | A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel. |
CVE-2021-45744 | Medium | 5.4 | 2022-01-06 | A Stored Cross Site Scripting (XSS) vulnerability exists in bludit 3.13.1 via the TAGS section in login panel. |
CVE-2021-35323 | Medium | 6.1 | 2021-10-19 | Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login. |
CVE-2020-20495 | Critical | 9.1 | 2021-09-01 | bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter. |
CVE-2020-18879 | Critical | 9.8 | 2021-08-20 | Unrestricted File Upload in Bludit v3.8.1 allows remote attackers to execute arbitrary code by uploading malicious files via the component 'bl-kereln/ajax/uplo… |
CVE-2021-25808 | High | 7.8 | 2021-07-23 | A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file. |
CVE-2020-23765 | High | 7.2 | 2021-05-21 | A file upload vulnerability was discovered in the file path /bl-plugins/backup/plugin.php on Bludit version 3.12.0. If an attacker is able to gain Administrato… |
CVE-2020-18190 | Critical | 9.1 | 2020-10-02 | Bludit v3.8.1 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /admin/ajax/upload-profile-picture. |
CVE-2020-15026 | Medium | 4.9 | 2020-06-24 | Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php. |
CVE-2020-15006 | Medium | 5.4 | 2020-06-24 | Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php. |
CVE-2020-13889 | Medium | 5.4 | 2020-06-06 | showAlert() in the administration panel in Bludit 3.12.0 allows XSS. |
CVE-2020-8812 | Medium | 5.4 | 2020-02-07 | Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug. |
CVE-2020-8811 | Medium | 4.3 | 2020-02-07 | ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures. |
CVE-2019-17240 | Critical | 9.8 | 2019-10-06 | bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Cl… |
CVE-2019-16334 | Medium | 4.8 | 2019-09-15 | In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: this may overlap CVE-2017-16636. |
CVE-2019-16113 | High | 8.8 | 2019-09-08 | Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code ca… |
CVE-2019-12742 | High | 8.8 | 2019-06-05 | Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/u… |
CVE-2019-12548 | High | 8.8 | 2019-06-03 | Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo. |
CVE-2018-1000811 | High | 8.8 | 2018-12-20 | bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Comma… |
CVE-2018-16313 | Medium | 6.1 | 2018-09-01 | Bludit 2.3.4 allows XSS via a user name. |
CVE-2017-16636 | Medium | 5.4 | 2017-11-06 | In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and edit post function body message context. Remote attackers are a… |