CVE-2019-12548

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/bludit/bludit/commit/d0843a4070c7d7fa596a7eb2130be15383013487Patch, Third Party Advisory
https://github.com/bludit/bludit/compare/5e5957c...77e85e7Release Notes, Third Party Advisory
https://github.com/bludit/bludit/releases/tag/3.9.0Release Notes, Third Party Advisory
https://github.com/bludit/bludit/commit/d0843a4070c7d7fa596a7eb2130be15383013487Patch, Third Party Advisory
https://github.com/bludit/bludit/compare/5e5957c...77e85e7Release Notes, Third Party Advisory
https://github.com/bludit/bludit/releases/tag/3.9.0Release Notes, Third Party Advisory

Timeline

Published: Jun 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-125499.8WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fing CVE-2019-12557.5A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Denial of Service Vulnera CVE-2019-125509.8WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to l CVE-2019-125515.5In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scri CVE-2019-125525.5In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of serv CVE-2019-125539.8In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the StrCat function (provided by the scri CVE-2019-125547.5In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the WSubStr function (provided by the scr CVE-2019-125557.5In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the SubStr function (provided by the scri CVE-2019-12567.8An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k CVE-2019-125626.1Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into th CVE-2019-125649.8In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backu CVE-2019-125665.4The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an accoun