bolt/bolt Security Advisories (15)
-
[HIGH] Bolt CMS vulnerable to authenticated remote code execution
PKSA-rqwt-k1f7-px9w CVE-2025-34086 GHSA-p9qc-8jjx-g8cg
Affected version: <=3.7.0
Reported by:
GitHub -
[MEDIUM] Bolt CMS Cross-site Scripting vulnerability
PKSA-j3yv-xgkj-14yx CVE-2024-7300 GHSA-xhqw-4hcq-fcvr
Affected version: <=3.7.1
Reported by:
GitHub -
[MEDIUM] Bolt Cross-site Scripting (XSS) via an image's alt or title field
PKSA-dd4d-zp1r-7fr7 CVE-2019-15484 GHSA-fp8m-xw3f-6h7x
Affected version: <3.6.10
Reported by:
GitHub -
[MEDIUM] Bolt Cross-site Scripting via the slug, teaser or title parameters
PKSA-9tcn-454k-r6y9 CVE-2019-9553 GHSA-2g23-qmmp-fvmr
Affected version: =3.6.4
Reported by:
GitHub -
[MEDIUM] Bolt Cross-site Scripting (XSS) via a title that is mishandled in the system log
PKSA-xvnh-qjyz-kbmd CVE-2019-15483 GHSA-ph84-vg7q-fqq8
Affected version: <3.6.10
Reported by:
GitHub -
[MEDIUM] Bolt CMS Stored XSS
PKSA-wqvm-nbyq-xr4c CVE-2017-11127 GHSA-hqxc-w9vw-3hp5
Affected version: <=3.2.14
Reported by:
GitHub -
[MEDIUM] Bolt stored Cross-site Scripting (XSS)
PKSA-sk13-57r9-p95m CVE-2017-11128 GHSA-5r9j-698h-2h5m
Affected version: =3.2.14
Reported by:
GitHub -
[MEDIUM] Bolt Cross-site Scripting (XSS) via text input click preview button
PKSA-v2pq-rwyj-n7r1 CVE-2018-19933 GHSA-gjx6-58xh-p7pw
Affected version: <3.6.2
Reported by:
GitHub -
[HIGH] Bolt Unrestricted Upload of File with Dangerous Type
PKSA-bm6g-tspj-1gvs CVE-2019-9185 GHSA-gmg5-f2gm-p3h7
Affected version: <3.6.5
Reported by:
GitHub -
[MEDIUM] Bolt Improper Access Control
PKSA-r9k9-jjg5-1423 CVE-2017-16754 GHSA-wr23-m9m2-jjf4
Affected version: <3.3.6
Reported by:
GitHub -
[HIGH] Bolt Cross Site Request Forgery (CSRF)
PKSA-mn6z-3ks2-rxpx CVE-2019-10874 GHSA-3g6c-88pf-m46f
Affected version: =3.6.6
Reported by:
GitHub -
[MEDIUM] OS Command injection in Bolt
PKSA-v1tz-xdz7-sr4b CVE-2020-28925 GHSA-w8cj-mvf9-mpc9
Affected version: <3.7.2
Reported by:
GitHub -
[HIGH] CSRF issue on preview pages in Bolt CMS
PKSA-gptm-wvwx-nssm CVE-2020-4040 GHSA-2q66-6cc3-6xm8
Affected version: <3.7.1
Reported by:
GitHub -
[HIGH] The filename of uploaded files vulnerable to stored XSS
PKSA-zsss-7rtd-kmzf CVE-2020-4041 GHSA-68q3-7wjp-7q3j
Affected version: <3.7.1
Reported by:
GitHub -
[MEDIUM] Cross-site Scripting in Bolt
PKSA-hxcd-7rxr-kwnh CVE-2019-15485 GHSA-cj8p-53v9-2c26
Affected version: <3.6.10
Reported by:
GitHub