CVE-2019-20058

Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the profiler page. NOTE: this is disputed because profiling was never intended for use in production. This is related to CVE-2018-12040...

CVE-2019-15485

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

CVE-2019-15483

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log...

CVE-2019-15484

Bolt before 3.6.10 has XSS via an image's alt or title field...

CVE-2015-7309

The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it...

Malicious code in github.com/boltdb-go/bolt (Go)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 9323424d3dfc7569b307842f79fb0c4bd960808214ec219f536fd5bb747422b2 This malicious Go package is a typosquat of the legitimate BoltDB package. It contains a backdoor that enables remote code execution...

bolt bug fix and enhancement update

An update is available for bolt. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.5...

CVE-2020-4041

In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to...

CVE-2020-4040

Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized...

GO-2025-3451 Vulnerability in github.com/boltdb-go/bolt

This module is a malicious typosquat, attempting to take advantage of confusion with the github.com/boltdb/bolt module...

PT-2025-5822 · Bolt · Bolt

Name of the Vulnerable Software and Affected Versions: bolt affected versions not specified Description: The issue concerns a malicious module that attempts to take advantage of confusion with the github.com/boltdb/bolt module, acting as a typosquat. Recommendations: At the moment, there is no...

PT-2025-4847 · Boltdb +2 · Boltdb +2

Name of the Vulnerable Software and Affected Versions: zot versions prior to 2.1.2 Description: The issue arises from the way group data is stored for users in the boltdb database, specifically as an append-list. This leads to group revocations or removals being ignored in the API. When a user lo...

Exploit for CVE-2025-25599

CVE-2025-25599 Details Bolt is an o...

CVE-2020-4041 affecting package bolt 0.9.2-2

CVE-2020-4041 affecting package bolt 0.9.2-2. This CVE either no longer is or was never applicable...

CVE-2020-28925 affecting package bolt 0.9.2-2

CVE-2020-28925 affecting package bolt 0.9.2-2. This CVE either no longer is or was never applicable...

CVE-2020-4040 affecting package bolt 0.9.2-2

CVE-2020-4040 affecting package bolt 0.9.2-2. This CVE either no longer is or was never applicable...

CVE-2017-16754 affecting package bolt 0.9.2-2

CVE-2017-16754 affecting package bolt 0.9.2-2. This CVE either no longer is or was never applicable...

CVE-2019-15483 affecting package bolt 0.9.2-2

CVE-2019-15483 affecting package bolt 0.9.2-2. This CVE either no longer is or was never applicable...

CVE-2022-31321 affecting package bolt 0.9.2-2

CVE-2022-31321 affecting package bolt 0.9.2-2. This CVE either no longer is or was never applicable...

CVE-2019-9185 affecting package bolt 0.9.2-2

CVE-2019-9185 affecting package bolt 0.9.2-2. This CVE either no longer is or was never applicable...