Skip to content
OpenAdvisories

Vendor

bolt

7 known vulnerabilities.

Products

CMS 4 bolt 2 core 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2025-34086 Public exploit

    Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename

    Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, whic…

    bolt CMS bolt/bolt Packagist
  • High 8.6
    CVE-2020-4040 Public exploit

    CSRF issue on preview pages in Bolt CMS

    Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of p…

    bolt bolt bolt/bolt Packagist