Bludit
Monthly
Stored XSS in Bludit page creation functionality allows authenticated users with author privileges or higher to inject malicious JavaScript via the tags field, executing arbitrary code in victims' browsers when they access the affected page. Bludit versions 3.17.2 and 3.18.0 are confirmed vulnerable; the vendor did not respond with remediation details or clarify the full version range affected. This vulnerability poses moderate immediate risk (CVSS 5.1) but carries elevated concern because injected scripts could escalate privileges to administrator level if the victim has sufficient permissions, and the malicious resource is accessible without authentication.
Stored XSS in Bludit 3.16.2 allows authenticated users to inject malicious JavaScript into post content that executes when viewed by other users, enabling session hijacking and credential theft. The vulnerability exists because the application relies solely on client-side input validation while failing to sanitize or encode content server-side. Public exploit code is available, though no patch has been released yet.
Bludit 3.16.1 lacks CSRF protections on administrative endpoints, allowing attackers to trick authenticated admins into uninstalling plugins or installing malicious themes via crafted web requests. Public exploit code exists for this vulnerability, enabling unauthorized modification of site functionality and potential code execution through untrusted theme installation.
Stored XSS in Bludit page creation functionality allows authenticated users with author privileges or higher to inject malicious JavaScript via the tags field, executing arbitrary code in victims' browsers when they access the affected page. Bludit versions 3.17.2 and 3.18.0 are confirmed vulnerable; the vendor did not respond with remediation details or clarify the full version range affected. This vulnerability poses moderate immediate risk (CVSS 5.1) but carries elevated concern because injected scripts could escalate privileges to administrator level if the victim has sufficient permissions, and the malicious resource is accessible without authentication.
Stored XSS in Bludit 3.16.2 allows authenticated users to inject malicious JavaScript into post content that executes when viewed by other users, enabling session hijacking and credential theft. The vulnerability exists because the application relies solely on client-side input validation while failing to sanitize or encode content server-side. Public exploit code is available, though no patch has been released yet.
Bludit 3.16.1 lacks CSRF protections on administrative endpoints, allowing attackers to trick authenticated admins into uninstalling plugins or installing malicious themes via crafted web requests. Public exploit code exists for this vulnerability, enabling unauthorized modification of site functionality and potential code execution through untrusted theme installation.