CVE-2023-31698

MEDIUM

Bludit 3.14.1 - Stored Cross-Site Scripting via SVG Site Logo Upload

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-31698. PoCs published by Rahad Chowdhury.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Bludit CMS v3.14.1 by uploading a malicious SVG file containing JavaScript code. The payload triggers an alert popup when the uploaded logo is viewed.

Description

Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).

Exploits (1)

exploitdb WORKING POC VERIFIED
by Rahad Chowdhury · textwebappsphp
https://www.exploit-db.com/exploits/51476

This exploit demonstrates a stored XSS vulnerability in Bludit CMS v3.14.1 by uploading a malicious SVG file containing JavaScript code. The payload triggers an alert popup when the uploaded logo is viewed.

Classification
Working Poc 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Bludit CMS v3.14.1
Auth required
Prerequisites: Authenticated access to the Bludit admin panel
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Scores

CVSS v3 5.4
EPSS 0.0259
EPSS Percentile 83.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
bludit/bludit 3.14.1
Published May 17, 2023
Tracked Since Feb 18, 2026