CVE-2023-34845

Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to execute arbitrary web scripts or HTML via uploading a crafted SVG file. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).

• CWE-434

• https://github.com/bludit/bludit/issues/1212#issuecomment-649514491
• https://github.com/bludit/bludit/issues/1369#issuecomment-940806199
• https://github.com/bludit/bludit/issues/1508Exploit, Issue Tracking
• https://github.com/bludit/bludit/issues/1212#issuecomment-649514491
• https://github.com/bludit/bludit/issues/1369#issuecomment-940806199
• https://github.com/bludit/bludit/issues/1508Exploit, Issue Tracking

Published

Jun 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34839A Cross Site Request Forgery (CSRF) vulnerability in Issabel…6.8
• CVE-2023-3484An issue has been discovered in GitLab EE affecting all vers…6.5
• CVE-2023-34840angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was disco…6.1
• CVE-2023-34842Remote Code Execution vulnerability in DedeCMS through 5.7.1…9.8
• CVE-2023-34843Traggo Server 0.3.0 is vulnerable to directory traversal via…7.5
• CVE-2023-34844Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privi…9.8
• CVE-2023-34849An unauthorized command injection vulnerability exists in th…9.8
• CVE-2023-3485Insecure defaults in open-source Temporal Server before vers…3.6
• CVE-2023-34852PublicCMS <=V4.0.202302 is vulnerable to Insecure Permission…9.8
• CVE-2023-34853Buffer Overflow vulnerability in Supermicro motherboard X12D…7.8
• CVE-2023-34855A Cross Site Scripting (XSS) vulnerability in Youxun Electro…4.8
• CVE-2023-34856A Cross Site Scripting (XSS) vulnerability in D-Link DI-7500…5.4