Bludit CMS - Stored XSS
Description
Bludit CMS version 3.22.0 contains a stored cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts which execute when users view the affected content.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A stored XSS vulnerability exists in Bludit CMS version 3.22.0. This flaw permits attackers to inject malicious scripts that are persistently stored and executed in the context of users accessing the compromised content. No further technical details or exploitation methods are provided.
Potential Impact
Successful exploitation can lead to execution of arbitrary scripts in the context of users viewing the affected content, potentially enabling session hijacking, defacement, or other malicious actions. There is no information about active exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted content in Bludit CMS 3.22.0.
Technical Details
- Version
- 3.22.0
- Author
- Saud Alenazi
- Platform
- Windows 10 x64
- Edb Id
- 52670
- Has Exploit Code
- true
- Code Language
- text
- Exploit Sophistication
- 6
- Weaponization Potential
- 5
- Stealth Capability
- 7
- Ai Analysis Type
- exploit-specialized
Indicators of Compromise
Exploit Source Code
Exploit code for Bludit CMS - Stored XSS
# Exploit Title: Bludit CMS - Stored XSS # Date: 2026-07-30 # Exploit Author: Saud Alenazi # Vendor Homepage: https://www.bludit.com # Software Link: https://github.com/bludit/bludit/releases/tag/3.22.0 # Version: 3.22.0 # Tested on: Windows 10 x64 ## Description: sanitizeSVG() strips script/on* but does not remove XML processing instructions. Uploading an SVG with <?xml-stylesheet?> XSLT (method=html) results in stored XSS when the file is opened top-level as image/svg+xml. ## Payload (payl... (1537 more characters)
Threat ID: 6a971291acd9273b49060cf7
Added to database: 09/01/2026, 17:59:45 UTC
Last enriched: 10/14/2026, 23:31:53 UTC
Last updated: 10/16/2026, 23:46:29 UTC
Views: 137
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.