CVE-2021-35323

MEDIUM NUCLEI

Bludit 3.13.1 - Cross-Site Scripting via Admin Login Username

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-35323. PoCs published by Vasu. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Bludit 3.13.1 by injecting malicious JavaScript into the username field during login. The payload triggers when the input is rendered in the admin panel.

Description

Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login.

Exploits (1)

exploitdb WORKING POC
by Vasu · textwebappsphp
https://www.exploit-db.com/exploits/50529

This exploit demonstrates a stored XSS vulnerability in Bludit 3.13.1 by injecting malicious JavaScript into the username field during login. The payload triggers when the input is rendered in the admin panel.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Bludit 3.13.1
No auth needed
Prerequisites: Access to the Bludit admin login page
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Bludit 3.13.1 - Cross Site Scripting
MEDIUMVERIFIEDby r3Y3r53
Shodan: title:"Bludit" || http.title:"bludit"
FOFA: title="bludit"

References (2)

Core 2
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/bludit/bludit/issues/1327
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/164990/Bludit-3.13.1-Cross-Site-Scripting.html

Scores

CVSS v3 6.1
EPSS 0.0562
EPSS Percentile 91.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
bludit/bludit 3.13.1
Published Oct 19, 2021
Tracked Since Feb 18, 2026