CVE-2023-31698

Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).

• CWE-79

• http://packetstormsecurity.com/files/172462/Bludit-CMS-3.14.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/bludit/bludit/issues/1212#issuecomment-649514491
• https://github.com/bludit/bludit/issues/1369#issuecomment-940806199
• https://github.com/bludit/bludit/issues/1509Exploit
• http://packetstormsecurity.com/files/172462/Bludit-CMS-3.14.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/bludit/bludit/issues/1212#issuecomment-649514491
• https://github.com/bludit/bludit/issues/1369#issuecomment-940806199
• https://github.com/bludit/bludit/issues/1509Exploit

Published

May 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31677Insecure permissions in luowice 3.5.18 allow attackers to vi…7.5
• CVE-2023-31678Incorrect access control in Videogo v6.8.1 allows attackers …5.3
• CVE-2023-31679Incorrect access control in Videogo v6.8.1 allows attackers …7.5
• CVE-2023-3168The WP Reroute Email plugin for WordPress is vulnerable to S…6.1
• CVE-2023-31689In Wcms 0.3.2, an attacker can send a crafted request from a…9.8
• CVE-2023-3169The tagDiv Composer WordPress plugin before 4.2, used as a c…6.1
• CVE-2023-31699ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scrip…4.8
• CVE-2023-3170The tagDiv Composer WordPress plugin before 4.2, used as a c…4.8
• CVE-2023-31700TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is …8.8
• CVE-2023-31701TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is …8.8
• CVE-2023-31702SQL injection in the View User Profile in MicroWorld eScan M…7.2
• CVE-2023-31703Cross Site Scripting (XSS) in the edit user form in Microwor…9