Bludit vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-93365 Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full contHigh 7.1 · Sep 25, 2026
• CVE-2026-46657 Bludit is a content management system.High 7.1 · Jun 8, 2026
• CVE-2026-46656 Bludit is a content management system.High 8.8 · Jun 8, 2026
• CVE-2026-25099 Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be exeHigh 8.7 · Mar 27, 2026
• CVE-2023-53907 Bludit versions before 3.13.1 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to access arbitrary files.High 7.1 · Dec 17, 2025
• CVE-2024-24551 A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API.High 8.9 · Jun 24, 2024
• CVE-2024-24550 A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which High 8.9 · Jun 24, 2024
• CVE-2023-24674 Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin parameter.High 7.8 · Sep 1, 2023
• CVE-2020-20210 Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images.High 8.8 · Jun 26, 2023
• CVE-2023-31572 An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privileges via a crafted request.High 8.8 · May 16, 2023
• CVE-2020-19228 An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary files.High 7.2 · May 11, 2022
• CVE-2020-20495 bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter.Critical 9.1 · Aug 31, 2021
• CVE-2020-18879 Unrestricted File Upload in Bludit v3.8.1 allows remote attackers to execute arbitrary code by uploading malicious files via the component 'bl-kereln/ajax/uploaCritical 9.8 · Aug 20, 2021
• CVE-2021-25808 A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file.High 7.8 · Jul 23, 2021
• CVE-2020-23765 A file upload vulnerability was discovered in the file path /bl-plugins/backup/plugin.php on Bludit version 3.12.0.High 7.2 · May 21, 2021
• CVE-2020-18190 Bludit v3.8.1 is affected by directory traversal.Critical 9.1 · Oct 2, 2020
• CVE-2019-17240 bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or CliCritical 9.8 · Oct 6, 2019
• CVE-2019-16113 Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code canHigh 8.8 · Sep 8, 2019
• CVE-2019-12742 Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin.High 8.8 · Jun 5, 2019
• CVE-2019-12548 Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo.High 8.8 · Jun 3, 2019
• CVE-2018-1000811 bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote CommanHigh 8.8 · Dec 20, 2018