Skip to content
OpenAdvisories

Package · Packagist

bolt/bolt

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 5.3
    CVE-2020-28925

    OS Command injection in Bolt

    Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with the "How to Harden Your PHP for Better Security" guidance.

    bolt/bolt bolt Azure Linux Packagist
  • Medium 6.1
    CVE-2019-9553 Public exploit

    Bolt Cross-site Scripting via the slug, teaser or title parameters

    Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.

    bolt/bolt Packagist
  • Medium 6.1
    CVE-2019-15485

    Cross-site Scripting in Bolt

    Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.

    bolt/bolt bolt Azure Linux Packagist
  • Medium 6.1
    CVE-2019-15484

    Bolt Cross-site Scripting (XSS) via an image's alt or title field

    Bolt before 3.6.10 has XSS via an image's alt or title field.

    bolt/bolt bolt Azure Linux Packagist
  • Medium 6.1
    CVE-2019-15483

    Bolt Cross-site Scripting (XSS) via a title that is mishandled in the system log

    Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.

    bolt/bolt bolt Azure Linux Packagist
  • Medium 6.1
    CVE-2018-19933 Public exploit

    Bolt Cross-site Scripting (XSS) via text input click preview button

    Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.

    bolt/bolt Packagist
  • Medium 5.3
    CVE-2017-16754

    Bolt Improper Access Control

    Bolt before 3.3.6 does not properly restrict access to _profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php.

    bolt/bolt bolt Azure Linux Packagist
  • Medium 5.4
    CVE-2017-11127

    Bolt CMS Stored XSS

    Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header.

    bolt/bolt Packagist
  • Medium 5.4
    CVE-2017-11128

    Bolt stored Cross-site Scripting (XSS)

    Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry.

    bolt/bolt Packagist