I've just received this "security email"
Posted: Fri Sep 11, 2026 9:49 pm
Hello,
I've just received this "security email", Is it true?
I am a security researcher reporting this vulnerability in good faith. This mail is for good deeds: to keep people secure, and to protect the living of patients, readers, and the people who run this medical-tech portal. It is not a threat.
I exploited CVE-2026-41456 on https://tech-med.it on 11 Sep 2026. https://tech-med.it/chi publishes the redazione mailboxes below.
Status: EXPLOITED — confirmed live. Unauthenticated reflected XSS in the paginator. /admin/ is on the public internet. Apache lists upload UUID trees and editor profile photos.
CVSS (official)
Version Score Vector
3.1 6.1 Medium CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 5.1 Medium CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
A victim must open the link. This is not unauthenticated RCE and is not 9.3 / 10.0.
https://nvd.nist.gov/vuln/detail/CVE-2026-41456
Fix: Bludit commit 6732dde or disable Search. Options -Indexes.
Exploit (reproduced today)
GET https://tech-med.it/search/%22%3E%3Cimg ... in)%3E.gif
→ HTTP 200 text/html
Raw HTML (paginator — this is the exploit):
<a class="page-link" href="https://tech-med.it/search/"><img src=1 onerror=alert(document.domain)>.gif?page=2">Pagina successiva ►</a>
Admin (unauthenticated GET):
GET https://tech-med.it/admin/
→ HTTP 200 Bludit login
Set-Cookie: __Secure-BLUDIT-KEY=c1ut7qa1lretgingani979skj8; path=/; secure; HttpOnly; SameSite=Lax
HttpOnly stops document.cookie. It does not stop JavaScript from calling /admin/ if an editor opens the PoC while logged in.
Sample data from YOUR site (this is the evidence)
From https://tech-med.it/chi (live today):
Tech-Med.it — portale news medico / tecnologia
Comunicati: pivari (@) gmail.com
Redazione:
Fabrizio Pivari — Fondatore e Responsabile Editoriale
pivari (chiocciola) gmail punto com
Nicolò Ghibellini — Avvocato responsabile privacy e security
nicolo (chiocciola) avvghibellini punto com
Agnese Pivari — Fondatore e referente social media
agnese punto pivari (chiocciola) gmail punto com
Network TECH: Tech-Sport.it, Tech-Med.it
Featured today: "Le minacce cyber nel settore sanitario" (bix, 8 Sep 2026)
Apache “Index of” (no password) — live today:
Path Sample
/bl-content/uploads/ Tech-Med.it.png, pages/, profiles/, thumbnails/
/bl-content/uploads/pages/ 0d00330238a22ff300c6d3bd5b17b25b/, 0d7c63cc2d04f9a9354f57f8a2b5cc59/, 00513bfab98b91a52c8ae8cc7df21adb/ (dozens of UUID dirs)
/bl-content/uploads/profiles/ fabrizio.png, agnese.png (HTTP 200, no auth)
/bl-plugins/ api/, disqus/, html-code/, hit-counter/
/bl-kernel/ login.class.php, admin/, ajax/
XSS as tech-med.it can overlay a fake “secure login for healthcare readers” on your real domain, or ride /admin/ if an editor clicks while logged in.
I did not log in and did not change pages.
Remediation
Patch Bludit (commit 6732dde) or disable Search
Options -Indexes
CSP; restrict /admin/
Rotate the admin password after patching
FP
I've just received this "security email", Is it true?
I am a security researcher reporting this vulnerability in good faith. This mail is for good deeds: to keep people secure, and to protect the living of patients, readers, and the people who run this medical-tech portal. It is not a threat.
I exploited CVE-2026-41456 on https://tech-med.it on 11 Sep 2026. https://tech-med.it/chi publishes the redazione mailboxes below.
Status: EXPLOITED — confirmed live. Unauthenticated reflected XSS in the paginator. /admin/ is on the public internet. Apache lists upload UUID trees and editor profile photos.
CVSS (official)
Version Score Vector
3.1 6.1 Medium CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 5.1 Medium CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
A victim must open the link. This is not unauthenticated RCE and is not 9.3 / 10.0.
https://nvd.nist.gov/vuln/detail/CVE-2026-41456
Fix: Bludit commit 6732dde or disable Search. Options -Indexes.
Exploit (reproduced today)
GET https://tech-med.it/search/%22%3E%3Cimg ... in)%3E.gif
→ HTTP 200 text/html
Raw HTML (paginator — this is the exploit):
<a class="page-link" href="https://tech-med.it/search/"><img src=1 onerror=alert(document.domain)>.gif?page=2">Pagina successiva ►</a>
Admin (unauthenticated GET):
GET https://tech-med.it/admin/
→ HTTP 200 Bludit login
Set-Cookie: __Secure-BLUDIT-KEY=c1ut7qa1lretgingani979skj8; path=/; secure; HttpOnly; SameSite=Lax
HttpOnly stops document.cookie. It does not stop JavaScript from calling /admin/ if an editor opens the PoC while logged in.
Sample data from YOUR site (this is the evidence)
From https://tech-med.it/chi (live today):
Tech-Med.it — portale news medico / tecnologia
Comunicati: pivari (@) gmail.com
Redazione:
Fabrizio Pivari — Fondatore e Responsabile Editoriale
pivari (chiocciola) gmail punto com
Nicolò Ghibellini — Avvocato responsabile privacy e security
nicolo (chiocciola) avvghibellini punto com
Agnese Pivari — Fondatore e referente social media
agnese punto pivari (chiocciola) gmail punto com
Network TECH: Tech-Sport.it, Tech-Med.it
Featured today: "Le minacce cyber nel settore sanitario" (bix, 8 Sep 2026)
Apache “Index of” (no password) — live today:
Path Sample
/bl-content/uploads/ Tech-Med.it.png, pages/, profiles/, thumbnails/
/bl-content/uploads/pages/ 0d00330238a22ff300c6d3bd5b17b25b/, 0d7c63cc2d04f9a9354f57f8a2b5cc59/, 00513bfab98b91a52c8ae8cc7df21adb/ (dozens of UUID dirs)
/bl-content/uploads/profiles/ fabrizio.png, agnese.png (HTTP 200, no auth)
/bl-plugins/ api/, disqus/, html-code/, hit-counter/
/bl-kernel/ login.class.php, admin/, ajax/
XSS as tech-med.it can overlay a fake “secure login for healthcare readers” on your real domain, or ride /admin/ if an editor clicks while logged in.
I did not log in and did not change pages.
Remediation
Patch Bludit (commit 6732dde) or disable Search
Options -Indexes
CSP; restrict /admin/
Rotate the admin password after patching
FP