CVE-2026-27742

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27742", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-02-23T21:38:48.841Z", "datePublished": "2026-02-23T21:58:56.535Z", "dateUpdated": "2026-07-14T18:39:39.029Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "packageURL": "pkg:github/bludit/bludit", "product": "Bludit", "repo": "https://github.com/bludit/bludit", "vendor": "Bludit", "versions": [{"lessThanOrEqual": "3.16.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:*", "versionEndIncluding": "3.16.2"}]}]}], "credits": [{"lang": "en", "type": "finder", "value": "Catalin Iovita (@catalin-iovita)"}, {"lang": "en", "type": "finder", "value": "Beatriz Fresno Naumova"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality. The application performs client-side sanitation of content input but does not enforce equivalent sanitation on the server side. An authenticated user can inject arbitrary JavaScript into the content field of a post, which is stored and later rendered to other users without proper output encoding. When viewed, the injected script executes in the context of the victim\u2019s browser, allowing session hijacking, credential theft, content manipulation, or other actions within the user\u2019s privileges."}], "value": "Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality. The application performs client-side sanitation of content input but does not enforce equivalent sanitation on the server side. An authenticated user can inject arbitrary JavaScript into the content field of a post, which is stored and later rendered to other users without proper output encoding. When viewed, the injected script executes in the context of the victim\u2019s browser, allowing session hijacking, credential theft, content manipulation, or other actions within the user\u2019s privileges."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-14T18:39:39.029Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://github.com/bludit/bludit/issues/1579"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/bludit-stored-xss-in-post-content"}], "source": {"discovery": "EXTERNAL"}, "title": "Bludit <= 3.16.2 Stored XSS in Post Content", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T15:34:07.275774Z", "id": "CVE-2026-27742", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:34:29.907Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27742", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T15:34:07.275774Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:34:23.476Z"}}], "cna": {"title": "Bludit <= 3.16.2 Stored XSS in Post Content", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Catalin Iovita (@catalin-iovita)"}, {"lang": "en", "type": "finder", "value": "Beatriz Fresno Naumova"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/bludit/bludit", "vendor": "Bludit", "product": "Bludit", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.16.2"}], "packageURL": "pkg:github/bludit/bludit", "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/bludit/bludit/issues/1579", "tags": ["issue-tracking"]}, {"url": "https://www.vulncheck.com/advisories/bludit-stored-xss-in-post-content", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality. The application performs client-side sanitation of content input but does not enforce equivalent sanitation on the server side. An authenticated user can inject arbitrary JavaScript into the content field of a post, which is stored and later rendered to other users without proper output encoding. When viewed, the injected script executes in the context of the victim\u2019s browser, allowing session hijacking, credential theft, content manipulation, or other actions within the user\u2019s privileges.", "supportingMedia": [{"type": "text/html", "value": "Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality. The application performs client-side sanitation of content input but does not enforce equivalent sanitation on the server side. An authenticated user can inject arbitrary JavaScript into the content field of a post, which is stored and later rendered to other users without proper output encoding. When viewed, the injected script executes in the context of the victim\u2019s browser, allowing session hijacking, credential theft, content manipulation, or other actions within the user\u2019s privileges.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "3.16.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-14T18:39:39.029Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27742", "state": "PUBLISHED", "dateUpdated": "2026-07-14T18:39:39.029Z", "dateReserved": "2026-02-23T21:38:48.841Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-02-23T21:58:56.535Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "packageURL": "pkg:github/bludit/bludit", "product": "Bludit", "repo": "https://github.com/bludit/bludit", "vendor": "Bludit", "versions": [{"lessThanOrEqual": "3.16.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:*", "matchCriteriaId": "322D8358-50D7-40FC-AA49-6DCBC888C806", "versionEndExcluding": "3.16.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality. The application performs client-side sanitation of content input but does not enforce equivalent sanitation on the server side. An authenticated user can inject arbitrary JavaScript into the content field of a post, which is stored and later rendered to other users without proper output encoding. When viewed, the injected script executes in the context of the victim\u2019s browser, allowing session hijacking, credential theft, content manipulation, or other actions within the user\u2019s privileges."}, {"lang": "es", "value": "Bludit versi\u00f3n 3.16.2 contiene una vulnerabilidad de cross-site scripting (XSS) almacenada en la funcionalidad de contenido de publicaciones. La aplicaci\u00f3n realiza saneamiento del lado del cliente de la entrada de contenido, pero no aplica un saneamiento equivalente en el lado del servidor. Un usuario autenticado puede inyectar JavaScript arbitrario en el campo de contenido de una publicaci\u00f3n, que se almacena y luego se renderiza a otros usuarios sin una codificaci\u00f3n de salida adecuada. Cuando se visualiza, el script inyectado se ejecuta en el contexto del navegador de la v\u00edctima, permitiendo el secuestro de sesi\u00f3n, el robo de credenciales, la manipulaci\u00f3n de contenido u otras acciones dentro de los privilegios del usuario."}], "id": "CVE-2026-27742", "lastModified": "2026-07-14T19:16:53.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27742", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T15:34:07.275774Z", "version": "2.0.3"}}]}, "published": "2026-02-23T22:16:25.440", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/bludit/bludit/issues/1579"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/bludit-stored-xss-in-post-content"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.16.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Bludit", "source": "cna", "vendor": "Bludit"}, "product": "bludit", "vendor": "bludit"}], "analysis": {"en": {"generated_at": "2026-04-16T16:34:26.371685+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest Bludit release (later than 3.16.2) which includes server\u2011side sanitization for post content.", "If an upgrade is not immediately possible, enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.", "As a temporary measure, restrict or disable the ability for authenticated users to create or edit posts until the patch or policy is applied, or apply server\u2011side filtering to escape HTML characters before storing content."], "summary": {"action": "Apply Patch", "impact": "Stored cross\u2011site scripting that can lead to session hijacking and credential theft."}, "threat_synthesis": {"affected_systems": "The affected product is the Bludit content management system, specifically any installation running version 3.16.2 or earlier. No other vendors or product variants are listed as impacted, and the issue originates from the post\u2011content handling logic within the CMS core.", "description_and_impact": "Bludit version 3.16.2 includes a stored cross\u2011site scripting flaw that allows an authenticated user to inject arbitrary JavaScript into the post content field. The application only sanitizes input on the client side and fails to apply equivalent server\u2011side filtering or output encoding. When another user views the post, the malicious script executes in the victim\u2019s browser, giving the attacker the ability to hijack the session, steal credentials, or modify content within the victim\u2019s privileges. This represents a typical CWE\u201179 vulnerability involving unsanitized reflected input rendered as HTML.", "risk_and_exploitability": "The CVSS base score of 5.1 indicates a moderate risk, and the EPSS score of less than 1% points to a very low likelihood of exploitation in the wild at the time of this assessment. The vulnerability is not currently listed in the CISA Key Exploited Vulnerabilities catalog. The attack vector is a stored XSS that requires an authenticated user to insert malicious payloads; once an attacker creates a post containing the script, any unprivileged user who views that post will be exposed."}}}}, "created": "2026-02-24T09:54:42.314610+00:00", "updated": "2026-04-16T16:45:25.940538+00:00", "vendors": ["bludit", "bludit$PRODUCT$bludit"]}