Bolt Cross-site Scripting (XSS) via an image's alt or title field

Description

References

• nvd.nist.gov/vuln/detail/CVE-2019-15484 · ADVISORY
• bolt/bolt#7801 · WEB
• bolt/bolt · PACKAGE
• bolt/bolt release v3.6.10 · WEB

Weitere Schwachstellen in bolt/bolt

• CVE-2025-34086HOCH 8.8Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code exec…
• CVE-2024-7300MITTEL 5.4A vulnerability classified as problematic has been found in Bolt CMS 3.7.1. Affected is an unknown function of the file /bolt/editcontent/sh…
• CVE-2020-28925MITTEL 5.3Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with the "How to Harden Y…
• CVE-2020-4041MITTEL 6.1In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code …
• CVE-2020-4040MITTEL 4.3Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins…