CVE-2020-8812: Improper Neutralization of Input During Web Page Generation

Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug...

PT-2020-20297

Name of the Vulnerable Software and Affected Versions Bludit version 3.10.0 Description The issue allows authenticated users to change other users' profile pictures due to a problem in the ajax/profile-picture-upload.php file. Recommendations For Bludit version 3.10.0, update to a newer version...

PT-2020-20298 · Bludit · Bludit

Name of the Vulnerable Software and Affected Versions: Bludit version 3.10.0 Description: The issue allows users with Editor or Author roles to insert malicious JavaScript into the WYSIWYG editor. It's noted that the vendor considers this behavior as "not a bug". Recommendations: For Bludit versi...

Bludit - Directory Traversal Image File Upload Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Bludit Directory Traversal Image File Upload Vulnerability", 'Description' = %q This module exploits a vulnerability in Bludit. A remote user cou...

Bludit - Directory Traversal Image File Upload (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Bludit Directory Traversal Image File Upload Vulnerability", 'Description' = %q This module exploits a vulnerability in Bludit. A remote user cou...

Bludit Directory Traversal Image File Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Bludit Directory Traversal Image File Upload Vulnerability", 'Description' = %q This module exploits a vulnerability in Bludit. A remote user cou...

Bludit Brute Force Protection Mechanism Bypass Vulnerability

Bludit is a simple, fast and secure flat file CMS. A brute force protection mechanism bypass vulnerability exists in bl-kernel/security.class.php in Bludit 3.9.2, which can be exploited by an attacker to bypass the brute force protection mechanism via a variety of forged X-Forwarded-For or...

CVE-2019-17240

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers...

CVE-2019-17240

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers...

Design/Logic Flaw

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers...

CVE-2019-17240

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers...

CVE-2019-17240

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers...

CVE-2019-17240

Bludit 3.9.2 is affected by CVE-2019-17240 in bl-kernel/security.class.php, enabling bypass of the brute-force protection by forging X-Forwarded-For or Client-IP headers. This authentication bypass vulnerability allows repeated login attempts to bypass rate limiting, potentially leading to creden...

CVE-2019-17240: Improper Restriction of Excessive Authentication Attempts

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers...

PT-2019-15027

Name of the Vulnerable Software and Affected Versions Bludit versions 3.2.9 through 3.9.2 Description The issue allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers. This can be exploited by sending requests with...

CVE-2019-17240

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers. Recent assessments: noraj at May 08, 2021 7:26pm UTC reported: This is just a security bypass allowing an attacker t...

CVE-2019-16334

In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories - Add New Category - Name field. NOTE: this may overlap CVE-2017-16636...

CVE-2019-16334

In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories - Add New Category - Name field. NOTE: this may overlap CVE-2017-16636...

Cross site scripting

In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories - Add New Category - Name field. NOTE: this may overlap CVE-2017-16636...

CVE-2019-16334

CVE-2019-16334 corresponds to a persistent XSS vulnerability in Bludit v3.9.2, exploitable via the Categories → Add New Category → Name field. The linked sources consistently state a stored/persistent XSS risk affecting that UI entry, with note that it may overlap CVE-2017-16636. No explicit expl...