CVE-2023-34845

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to execute arbitrary web scripts or HTML via uploading a crafted SVG file. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jun 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-348499.8An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through 3.7.1.CVE-2023-34853.6Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access t CVE-2023-348529.8PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.CVE-2023-348537.8Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via manipulation of Smc CVE-2023-348546.6HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function.CVE-2023-348554.8A Cross Site Scripting (XSS) vulnerability in Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management Platform v1.02.040 a CVE-2023-348565.4A Cross Site Scripting (XSS) vulnerability in D-Link DI-7500G-CI-19.05.29A allows attackers to execute arbitrary code via uploading a crafte CVE-2023-34867.5An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbi CVE-2023-348659.8Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature.CVE-2023-348677.5Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_property_hashmap_create at jerry-core/ecma/base CVE-2023-348687.5Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start at jerry-core/parse CVE-2023-348696.1PHPJabbers Catering System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php?controller