Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

42 records

Vendor: Bludit Component: Bludit Clear all filters
TI-2026-03837 CVE-2026-4420 · GHSA-w5x8-257x-9rv5

Stored XSS via Page Creating functionality in Bludit

Priority LOW 22

Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its page creating functionality.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00164 Published 2026-04-07 No fix listed CWE-79
TI-2026-20265 CVE-2026-25099 · GHSA-vfmc-78c4-2f7w

Remote Code Execution via Unrestricted File Upload in Bludit

Priority MEDIUM 44

Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01993 Published 2026-03-27 Fixed in 3.18.4 CWE-434
TI-2026-20266 CVE-2026-25100 · GHSA-8v3q-hmmj-942m

Stored XSS via SVG File Upload in Bludit

Priority LOW 21

Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00198 Published 2026-03-27 No fix listed CWE-79
TI-2026-20267 CVE-2026-25101 · GHSA-fjj5-fj78-h28j

Session Fixation in Bludit

Priority LOW 22

Bludit allows user's session identifier to be set before authentication.

CVSS 4.0MEDIUM 4.8 Local No auth User interaction EPSS 0.0037 Published 2026-03-27 Fixed in 3.17.2 CWE-384
TI-2026-22101 CVE-2026-27741 · GHSA-xw6c-ffpm-fgcm

Bludit <= 3.16.1 CSRF in Plugin and Theme Management Endpoints

Priority MEDIUM 56

Bludit version 3.16.1 contains a cross-site request forgery (CSRF) vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00171 Published 2026-02-23 No fix listed CWE-352
TI-2026-22102 CVE-2026-27742 · GHSA-wg93-hp69-vv5w

Bludit <= 3.16.2 Stored XSS in Post Content

Priority LOW 22

Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00165 Published 2026-02-23 No fix listed CWE-79
TI-2023-30190 CVE-2023-53907 · GHSA-c3xc-px9v-223r

Bludit < 3.13.0 Authenticated Arbitrary File Download via Backup Plugin

Priority LOW 33

Bludit versions before 3.13.0 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to access arbitrary files.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00811 Published 2025-12-17 Fixed in 3.13.0 CWE-22
TI-2024-16176 CVE-2024-24554 · GHSA-8328-q9mx-pp5j

Bludit - Insecure Token Generation

Priority LOW 26

Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00242 Published 2024-06-24 No fix listed CWE-287
TI-2024-16175 CVE-2024-24553 · GHSA-cxm3-2c37-cc6h

Bludit uses SHA1 as Password Hashing Algorithm

Priority LOW 28

Bludit uses the SHA-1 hashing algorithm to compute password hashes.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00217 Published 2024-06-24 No fix listed CWE-916
TI-2024-16174 CVE-2024-24552 · GHSA-7pcp-vq94-mvr5

Bludit is Vulnerable to Session Fixation

Priority LOW 27

A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into authorizing a session ID of their choosing.

CVSS 4.0MEDIUM 5.6 Network High privileges User interaction EPSS 0.00392 Published 2024-06-24 No fix listed CWE-384
TI-2024-16173 CVE-2024-24551 · GHSA-2xxr-prx9-m533

Bludit - Remote Code Execution (RCE) through Image API

Priority HIGH 74

A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API.

CVSS 4.0HIGH 8.9 Network High privileges No interaction EPSS 0.00755 Published 2024-06-24 No fix listed CWE-434
TI-2024-16172 CVE-2024-24550 · GHSA-37f5-2pjr-46xw

Bludit - Remote Code Execution (RCE) through File API

Priority HIGH 74

A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which leads to arbitrary code execution on the server.

CVSS 4.0HIGH 8.9 Network High privileges No interaction EPSS 0.00692 Published 2024-06-24 No fix listed CWE-434
Load more