EUVD-2026-24239
GHSA-xmmc-cmm8-3rvm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
7DescriptionCVE.org
Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of users who visit crafted URLs containing the payload, potentially stealing session cookies or performing actions on behalf of affected users.
AnalysisAI
Reflected cross-site scripting in Bludit CMS search plugin allows unauthenticated attackers to inject arbitrary JavaScript through malicious search queries. When users visit attacker-crafted URLs containing the XSS payload, malicious scripts execute in their browsers, enabling session cookie theft and actions performed on behalf of victims. Publicly available exploit code exists; patch available via commit 6732dde.
Technical ContextAI
Bludit CMS is a flat-file content management system. The vulnerability resides in the search plugin's input validation mechanism, which fails to properly sanitize or encode user-supplied search query parameters before reflecting them in HTTP responses. This is a classic reflected XSS (CWE-79) where attacker-controlled input flows directly into the HTML output without context-appropriate encoding. The vulnerability affects all versions prior to commit 6732dde, as indicated by the CPE wildcard (cpe:2.3:a:bludit:bludit:*). The fix involves proper output encoding or input validation in the search functionality.
RemediationAI
Upgrade Bludit CMS to a version incorporating commit 6732dde or later; exact released version number not specified in advisory, so administrators should pull the latest development branch or wait for the next stable release that includes this commit. As immediate workaround, disable the search plugin entirely if not critical to operations, or implement Web Application Firewall (WAF) rules to block search requests containing common XSS payload patterns (script tags, event handlers, JavaScript: URLs). Additionally, enforce Content Security Policy (CSP) headers with strict script-src directives to mitigate impact if XSS executes despite input filtering. Apply httponly and secure flags to session cookies to prevent JavaScript-based theft. Note that disabling the search plugin removes functionality, and WAF bypass is possible with obfuscated payloads, so patching remains the primary fix.
Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .j
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many
Bludit v3.8.1 is affected by directory traversal. Rated critical severity (CVSS 9.1), this vulnerability is remotely exp
A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code throu
A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arb
An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privilege
bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages
Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin p
A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a cr
An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary fi
Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login. Rated medium severity
Bludit 2.3.4 allows XSS via a user name. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, n
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today