Bolt Cross-site Scripting via the slug, teaser or title parameters

Description

References

• nvd.nist.gov/vuln/detail/CVE-2019-9553 · ADVISORY
• bolt/bolt · PACKAGE
• packetstormsecurity.com/files/151943/Bold-CMS-3.6.4-Cross-Site-Scripting.html · WEB
• exploit-db.com/exploits/46495 · WEB

Mais vulnerabilidades de bolt/bolt

• CVE-2025-34086ALTO 8.8Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code exec…
• CVE-2024-7300MÉDIO 5.4A vulnerability classified as problematic has been found in Bolt CMS 3.7.1. Affected is an unknown function of the file /bolt/editcontent/sh…
• CVE-2020-28925MÉDIO 5.3Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with the "How to Harden Y…
• CVE-2020-4041MÉDIO 6.1In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code …
• CVE-2020-4040MÉDIO 4.3Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins…