CVE-2021-27367

Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal...

EUVD-2021-0567

Malware in sbrugna...

EUVD-2022-1977

Malicious code in bioql PyPI...

EUVD-2022-4770

Malicious code in bioql PyPI...

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log

...

WordPress Backup Bolt plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan Patchstack Alliance in WordPress Plugin Backup Bolt versions = 1.5.0...

Cross-site Scripting (XSS)

bolt/bolt is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization of the title and textarea parameters in the Showcase Creation Handler, allowing injection of malicious scripts...

CVE-2019-15484

Bolt before 3.6.10 has XSS via an image's alt or title field...

CVE-2015-7309

The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it...

Code injection

Bolt before 3.3.6 does not properly restrict access to profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php...