Bolt Cross-site Scripting (XSS) via text input click preview button

Description

References

• nvd.nist.gov/vuln/detail/CVE-2018-19933 · ADVISORY
• bolt/bolt · PACKAGE
• rdincel1/Bolt-CMS-3.6.2---Cross-Site-Scripting · WEB
• exploit-db.com/exploits/46014 · WEB
• raifberkaydincel.com/bolt-cms-xss-vulnerability.html · WEB
• exploit-db.com/exploits/46014 · Third Party Advisory

More vulnerabilities in bolt/bolt

• CVE-2025-34086HIGH 8.8Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code exec…
• CVE-2024-7300MEDIUM 5.4A vulnerability classified as problematic has been found in Bolt CMS 3.7.1. Affected is an unknown function of the file /bolt/editcontent/sh…
• CVE-2020-28925MEDIUM 5.3Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with the "How to Harden Y…
• CVE-2020-4041MEDIUM 6.1In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code …
• CVE-2020-4040MEDIUM 4.3Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins…