GHSA-2G23-QMMP-FVMR Bolt Cross-site Scripting via the slug, teaser or title parameters

Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933...

Bolt Cross-site Scripting (XSS) via a title that is mishandled in the system log

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log...

GHSA-PH84-VG7Q-FQQ8 Bolt Cross-site Scripting (XSS) via a title that is mishandled in the system log

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log...

new packages: bolt

An update is available for bolt. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterprise...

GHSA-HQXC-W9VW-3HP5 Bolt CMS Stored XSS

Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header...

Bolt CMS Stored XSS

Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header...

Bolt stored Cross-site Scripting (XSS)

Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry...

GHSA-5R9J-698H-2H5M Bolt stored Cross-site Scripting (XSS)

Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry...

Malicious code in bolt-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40639c5f8b34134db966654cf56e02dd69cd250d3a0d8873dba524ac9c75ae7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1645 Malicious code in bolt-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40639c5f8b34134db966654cf56e02dd69cd250d3a0d8873dba524ac9c75ae7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Bolt Cross-site Scripting (XSS) via text input click preview button

Bolt CMS 3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry...

GHSA-GJX6-58XH-P7PW Bolt Cross-site Scripting (XSS) via text input click preview button

Bolt CMS 3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry...

Bolt Unrestricted Upload of File with Dangerous Type

Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension...

GHSA-GMG5-F2GM-P3H7 Bolt Unrestricted Upload of File with Dangerous Type

Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension...

GHSA-WR23-M9M2-JJF4 Bolt Improper Access Control

Bolt before 3.3.6 does not properly restrict access to profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php...

Bolt Cross Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file...

Bolt Improper Access Control

Bolt before 3.3.6 does not properly restrict access to profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php...

GHSA-3G6C-88PF-M46F Bolt Cross Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file...

GHSA-GPRH-7767-CW39 Code Injection in Bolt CMS

Bolt CMS = 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution...

Code Injection in Bolt CMS

Bolt CMS = 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution...