CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login. |
| 19/10/2021 |
| CVE-2020-20495 | 严重9.1 | bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter. | 01/09/2021 |
| CVE-2020-18879 | 严重9.8 | Unrestricted File Upload in Bludit v3.8.1 allows remote attackers to execute arbitrary code by uploading malicious files via the component 'bl-kereln/ajax/upload-logo.php'. | 20/08/2021 |
| CVE-2021-25808 | 高危7.8 | A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file. | 23/07/2021 |
| CVE-2020-23765 | 高危7.2 | A file upload vulnerability was discovered in the file path /bl-plugins/backup/plugin.php on Bludit version 3.12.0. If an attacker is able to gain Administrator rights they will be able to use unsafe plugins to upload a backup file and control the server. | 21/05/2021 |
| CVE-2020-18190 | 严重9.1 | Bludit v3.8.1 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /admin/ajax/upload-profile-picture. | 02/10/2020 |
| CVE-2020-15026 | 中危4.9 | Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php. | 24/06/2020 |
| CVE-2020-15006 | 中危5.4 | Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php. | 24/06/2020 |
| CVE-2020-13889 | 中危5.4 | showAlert() in the administration panel in Bludit 3.12.0 allows XSS. | 06/06/2020 |
| CVE-2020-8812 | 中危5.4 | Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug. | 07/02/2020 |
| CVE-2020-8811 | 中危4.3 | ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures. | 07/02/2020 |
| CVE-2019-17240 | 严重9.8 | bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers. | 06/10/2019 |
| CVE-2019-16334 | 中危4.8 | In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: this may overlap CVE-2017-16636. | 15/09/2019 |
| CVE-2019-16113 | 高危8.8 | Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname. | 08/09/2019 |
| CVE-2019-12742 | 高危8.8 | Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference (a modified username POST parameter). | 05/06/2019 |
| CVE-2019-12548 | 高危8.8 | Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo. | 03/06/2019 |
| CVE-2018-1000811 | 高危8.8 | bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code. | 20/12/2018 |