CVE-2019-20058

CVE-2019-20058 affects Bolt 3.7.0 when the Symfony Web Profiler is enabled. The issue is an XSS vulnerability caused by unsanitized input (search?search=) being reflected on the profiler page; the vulnerability is disputed since the profiler is not intended for production use. Related to CVE-2018...

CVE-2019-20058

Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the profiler page. NOTE: this is disputed because profiling was never intended for use in production. This is related to CVE-2018-12040...

PT-2019-16071 · Symfony +1 · Symfony Webprofiler +1

Name of the Vulnerable Software and Affected Versions: Bolt version 3.7.0 Description: The issue allows for XSS because unsanitized search input is shown on the profiler page when Symfony Web Profiler is used. It is noted that this issue is disputed as profiling was never intended for use in...

GHSA-CJ8P-53V9-2C26 Cross-site Scripting in Bolt

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

Cross-site Scripting in Bolt

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

Cross-Site Request Forgery (CSRF)

Bolt is vulnerable to cross-site request forgery CSRF. It allows an attacker to trick an authenticated user to submit a malicious request to execute action on behalf of the attacker...

Bolt CMS Cross-Site Request Forgery Vulnerability (CNVD-2019-36972)

Bolt CMS is a PHP-based open source content management system for the Bolt community. Bolt CMS cross-site request forgery vulnerability, an attacker can exploit the vulnerability in the user has logged into the target site , to induce the user to visit an attack page , to take advantage of the...

Bolt CMS 3.6.10 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: Bolt CMS 3.6.10 - Cross-Site Request Forgery Exploit Author: r3m0t3nu11Zero-Way Vendor Homepage: https://bolt.cm/ Software Link: https://bolt.cm/ Version: up to date and 6.5 Tested on: Linux CVE : CVE-2019-1759 last version Csrf...

Bolt CMS 3.6.10 - Cross-Site Request Forgery

Bolt CMS 3.6.10 - Cross-Site Request Forgery Exploit Title: Bolt CMS 3.6.10 - Cross-Site Request Forgery Date: 2019-10-15 Exploit Author: r3m0t3nu11Zero-Way Vendor Homepage: https://bolt.cm/ Software Link: https://bolt.cm/ Version: up to date and 6.5 Tested on: Linux CVE : CVE-2019-1759 last...

Bolt CMS 3.6.10 Cross Site Request Forgery

Exploit Title: Bolt CMS 3.6.10 - Cross-Site Request Forgery Date: 2019-10-15 Exploit Author: r3m0t3nu11Zero-Way Vendor Homepage: https://bolt.cm/ Software Link: https://bolt.cm/ Version: up to date and 6.5 Tested on: Linux CVE : N/A last version Csrf p0c Bolt v 3.x exploit 0day Bolt v 3.x csrf -...

Bolt CMS 3.6.10 - Cross-Site Request Forgery

Exploit Title: Bolt CMS 3.6.10 - Cross-Site Request Forgery Date: 2019-10-15 Exploit Author: r3m0t3nu11Zero-Way Vendor Homepage: https://bolt.cm/ Software Link: https://bolt.cm/ Version: up to date and 6.5 Tested on: Linux CVE : CVE-2019-17591 last version Csrf p0c Bolt v 3.x exploit 0day Bolt v...

Bolt CMS Cross-Site Scripting Vulnerability (CNVD-2019-29166)

Bolt CMS is a PHP-based open source content management system for the Bolt community. A cross-site scripting vulnerability exists in the Controller/Async/FilesystemManager.php file in Bolt CMS versions prior to 3.6.10, which can be exploited by an attacker to execute client-side code...

Bolt CMS Cross-Site Scripting Vulnerability (CNVD-2019-29167)

Bolt CMS is a PHP-based open source content management system for the Bolt community. A cross-site scripting vulnerability exists in Bolt CMS versions prior to 3.6.10, which can be exploited by an attacker to execute client-side code...

Cross-Site Scripting (XSS)

bolt/bolt is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the user input, allowing a malicious attacker to inject and execute arbitrary html and script code into the web site through an image's alt or the title field...

Cross-site Scripting (XSS)

Bolt is vulnerable to cross-site scripting XSS. The vulnerability exists due to lack of proper handling of Create file for system log in file manager, allowing a remote attacker to inject arbitrary Javascript into a victim's browser through the affected parameters...

CVE-2019-15485

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

CVE-2019-15483

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log...

CVE-2019-15484

Bolt before 3.6.10 has XSS via an image's alt or title field...

CVE-2019-15483

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log...

CVE-2019-15484

Bolt before 3.6.10 has XSS via an image's alt or title field...