High severity8.8NVD Advisory· Published Jun 5, 2019· Updated Jun 17, 2026

CVE-2019-12742

Description

Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference (a modified username POST parameter).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Bludit/Bludit2 versions
cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:*range: <3.9.1
- (no CPE)range: <3.9.1
Bludit/Bluditdescription

Patches

Vulnerability mechanics

References

github.com/bludit/bludit/commit/a1bb333153fa8ba29a88cfba423d810f509a2b37nvdPatchThird Party Advisory
github.com/bludit/bludit/releases/tag/3.9.1nvdRelease NotesThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000