BBludit

Products

Exploited and recent CVEs

• CVE-2026-93366 Medium 5.4 Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints 0.2%
• CVE-2026-93365 Medium 6.5 Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint 0.2%
• CVE-2026-93364 Medium 4.3 Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit() 0.2%
• CVE-2026-72576 Medium 5.4 Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload 0.3%
• CVE-2026-46657 High 7.1 Bludit's persistent authentication tokens not revoked upon account disablement 0.3%
• CVE-2026-46656 High 8.8 Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions 0.3%
• CVE-2026-41456 Medium 5.1 Bludit CMS Reflected XSS via Search Plugin 3.5%
• CVE-2026-4420 Medium 5.1 Stored XSS via Page Creating functionality in Bludit 0.2%
• CVE-2026-25099 High 8.7 Remote Code Execution via Unrestricted File Upload in Bludit 2.0%
• CVE-2026-25100 Medium 4.8 Stored XSS via SVG File Upload in Bludit 0.2%
• CVE-2026-25101 Medium 4.8 Session Fixation in Bludit 0.4%
• CVE-2026-27741 Medium 4.3 Bludit <= 3.16.1 CSRF in Plugin and Theme Management Endpoints 0.2%
• CVE-2026-27742 Medium 5.4 Bludit <= 3.16.2 Stored XSS in Post Content 0.2%
• CVE-2023-53907 Medium 6.5 Bludit < 3.13.0 Authenticated Arbitrary File Download via Backup Plugin 0.8%
• CVE-2024-24554 Medium 6.0 Bludit - Insecure Token Generation 0.2%
• CVE-2024-24553 Medium 5.9 Bludit uses SHA1 as Password Hashing Algorithm 0.2%
• CVE-2024-24552 Medium 5.6 Bludit is Vulnerable to Session Fixation 0.4%
• CVE-2024-24551 High 8.9 Bludit - Remote Code Execution (RCE) through Image API 0.8%
• CVE-2024-24550 High 8.9 Bludit - Remote Code Execution (RCE) through File API 0.7%