GCVE - cpe:2.3:a:bludit:bludit:3.9.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:bludit:bludit:3.9.2:*:*:*:*:*:*:*

part: a version: 3.9.2 update: *

Vendor	Bludit (`67bdaa9c-b7c5-5830-82a9-c3e7bf8573ca`)
Product	Bludit (`4c1d3b44-ab61-5860-bb04-857b81b46310`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/bludit/bludit`	purl2cpe	2026-06-01 10:17:12.034971

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-20210`	vulnerable	2026-06-08 05:21:03.941095	Details available Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. Published: 2023-06-26T00:00:00.000Z Updated: 2024-11-27T19:45:35.718Z Open on db.gcve.eu Reference links https://github.com/bludit/bludit/issues/1079	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-17240`	vulnerable	2026-06-08 05:13:10.160454	Details available LOW (3.7) bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers. Published: 2019-10-06T18:32:20.000Z Updated: 2024-08-05T01:33:17.328Z Open on db.gcve.eu Reference links https://rastating.github.io/bludit-brute-force-mitigation-bypass/ https://github.com/bludit/bludit/pull/1090 http://packetstormsecurity.com/files/158875/Bludit-3.9.2-Authentication-Bruteforce-Mitigation-Bypass.html http://packetstormsecurity.com/files/159664/Bludit-3.9.2-Bruteforce-Mitigation-Bypass.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-16334`	vulnerable	2026-06-08 05:13:08.329166	Details available In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: this may overlap CVE-2017-16636. Published: 2019-09-15T21:22:43.000Z Updated: 2024-08-05T01:10:41.756Z Open on db.gcve.eu Reference links https://github.com/bludit/bludit/issues/1078	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-16113`	vulnerable	2026-06-08 05:13:07.746737	Details available Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname. Published: 2019-09-08T20:50:28.000Z Updated: 2024-08-05T01:03:32.768Z Open on db.gcve.eu Reference links https://github.com/bludit/bludit/issues/1081 http://packetstormsecurity.com/files/155295/Bludit-Directory-Traversal-Image-File-Upload.html http://packetstormsecurity.com/files/157988/Bludit-3.9.12-Directory-Traversal.html http://packetstormsecurity.com/files/158569/Bludit-3.9.2-Directory-Traversal.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.