Skip to content
OpenAdvisories

Package · Packagist

bolt/bolt

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.5
    CVE-2025-34086 Public exploit

    Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename

    Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, whic…

    bolt CMS bolt/bolt bolt Azure Linux Packagist
  • High 8.6
    CVE-2020-4040 Public exploit

    CSRF issue on preview pages in Bolt CMS

    Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of p…

    bolt bolt bolt/bolt bolt Azure Linux Packagist
  • Medium 6.1
    CVE-2019-9553 Public exploit

    Bolt Cross-site Scripting via the slug, teaser or title parameters

    Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.

    bolt/bolt Packagist
  • High 8.8
    CVE-2019-10874 Public exploit

    Bolt Cross Site Request Forgery (CSRF)

    Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file.

    bolt/bolt Packagist
  • Medium 6.1
    CVE-2018-19933 Public exploit

    Bolt Cross-site Scripting (XSS) via text input click preview button

    Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.

    bolt/bolt Packagist