CVE-2019-12742

Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference (a modified username POST parameter).

• CWE-639

• https://github.com/bludit/bludit/commit/a1bb333153fa8ba29a88cfba423d810f509a2b37Patch, Third Party Advisory
• https://github.com/bludit/bludit/releases/tag/3.9.1Release Notes, Third Party Advisory
• https://github.com/bludit/bludit/commit/a1bb333153fa8ba29a88cfba423d810f509a2b37Patch, Third Party Advisory
• https://github.com/bludit/bludit/releases/tag/3.9.1Release Notes, Third Party Advisory

Published

Jun 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12735getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 all…
• CVE-2019-12736JetBrains Ktor framework before 1.2.0-rc does not sanitize t…9.8
• CVE-2019-12737UserHashedTableAuth in JetBrains Ktor framework before 1.2.0…5.3
• CVE-2019-12739lib/Controller/ExtractionController.php in the Extract add-o…9
• CVE-2019-1274An information disclosure vulnerability exists when the Wind…5.5
• CVE-2019-12741XSS exists in the HAPI FHIR testpage overlay module of the H…
• CVE-2019-12743HumHub Social Network Kit Enterprise v1.3.13 allows remote a…
• CVE-2019-12744SeedDMS before 5.1.11 allows Remote Command Execution (RCE) …
• CVE-2019-12745out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cr…
• CVE-2019-12746An issue was discovered in Open Ticket Request System (OTRS)…6.5
• CVE-2019-12747TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deseri…8.8
• CVE-2019-12748TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XS…6.1