Bludit CMS <= 3.20.0 - Cross-Site Scripting

Bludit CMS contains a reflected XSS caused by improper sanitization in the search plugin, letting unauthenticated attackers inject arbitrary JavaScript, exploit requires crafted malicious search query. id: CVE-2026-41456 info: name: Bludit CMS = 3.20.0 - Cross-Site Scripting author: 0xAkoko...

CVE-2026-25099

CVE-2026-25099 - Неограниченная загрузка файлов через API Bludit CMS с последующим выполнением кода RCE Описание Версии Bludit CMS до 3.18.4 позволяют аутентифицированному атакующему с действительным API-токеном загружать файлы любого типа и расширения через конечную точку POST /api/files/. Функц...

CVE-2019-17240

CVE-2019-17240 Эксплойт Версии до 3.9.2 включительно CMS Bludit уязвимы для обхода механизма защиты от брутфорса, который блокирует пользователей, совершивших 10 или более неудачных попыток входа. Уязвимость была обнаружена Rastating. Отправка запроса на вход с изменяющимся значением заголовка...

CVE-2016-16113-POC

Get RCE — эксплойт Bludit CMS | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| Автоматизированный инструмент эксплуатации, который объединяет CVE-2019-17240 обход аутентификации и CVE-2019-16113 произвольная загрузка файлов для достижения...

CVE-2026-95153

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

EUVD-2026-93552

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

CVE-2026-95153

A vulnerability exists in Bludit CMS 3.22.0 that allows a remote attacker to obtain sensitive information . The issue is accessible via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints. No specific root cause, exploit details, or remediation steps are provided in the available docum...

CVE-2026-95153

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

PT-2026-106804

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

Bludit-3.9.2-Auth-Bruteforce-Bypass-CVE-2019-17240

Script de contournement de l'atténuation de force brute Bludit Présentation Ce script est une implémentation Bash remaniée d'un exploit ciblant le CMS Bludit version = 3.9.2. Il exploite une vulnérabilité CVE-2019-17240 qui permet de forcer les mots de passe par brute force en contournant la...

CVE-2026-93366

Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints...

CVE-2026-93364

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and...

CVE-2026-93365

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...

CVE-2026-93366

Bludit CMS version 3.22.0 and earlier is vulnerable to an authorization bypass in the bl-kernel/ajax/ endpoints. Authenticated users with the Author role can enumerate and delete media files belonging to other users, including administrators, by providing arbitrary uuid parameters. The vulnerabil...

CVE-2026-93366 Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints

Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints...

EUVD-2026-87211

Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints...

CVE-2026-93366 Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints

Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints...

CVE-2026-93366 Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints

Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints...

EUVD-2026-87209

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...

CVE-2026-93365 Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...