CVE-2019-15485

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

CVE-2019-15485: Improper Neutralization of Input During Web Page Generation

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

PT-2019-14214

Name of the Vulnerable Software and Affected Versions Bolt versions prior to 3.6.10 Description The issue is related to cross-site scripting XSS that can occur via the createFolder or createFile functions in the Controller/Async/FilesystemManager.php file. Recommendations For versions prior to...

PT-2019-19422

Name of the Vulnerable Software and Affected Versions Bolt versions prior to 3.6.5 Description The issue allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension. This is possible due to a flaw in the...

CVE-2019-9185: Unrestricted Upload of File with Dangerous Type

Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension...