Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality. The application performs client-side sanitation of content input but does not enforce equivalent sanitation on the server side. An authenticated user can inject arbitrary JavaScript into the content field of a post, which is stored and later rendered to other users without proper output encoding. When viewed, the injected script executes in the context of the victim’s browser, allowing session hijacking, credential theft, content manipulation, or other actions within the user’s privileges.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27742 Stored Cross-Site Scripting Vulnerability in Bludit CMS 3.16.2 via Post Content https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27742
Post summary
A stored XSS vulnerability (CVE-2026-27742) has been disclosed for Bludit CMS 3.16.2, affecting post content.
CVE-2026-27742 Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality. The application performs client-side sanitation of… https://www.cve.org/CVERecord?id=CVE-2026-27742
Post summary
The post announces a stored XSS vulnerability in Bludit 3.16.2, noting client‑side sanitation but providing no details on exploitation or mitigation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | bludit | bludit | - | - | - |