Bolt CMS Cross-Site Scripting Vulnerability (CNVD-2019-29166)

Bolt CMS is a PHP-based open source content management system for the Bolt community. A cross-site scripting vulnerability exists in the Controller/Async/FilesystemManager.php file in Bolt CMS versions prior to 3.6.10, which can be exploited by an attacker to execute client-side code...

Cross-Site Scripting (XSS)

bolt/bolt is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the user input, allowing a malicious attacker to inject and execute arbitrary html and script code into the web site through an image's alt or the title field...

Cross-site Scripting (XSS)

Bolt is vulnerable to cross-site scripting XSS. The vulnerability exists due to lack of proper handling of Create file for system log in file manager, allowing a remote attacker to inject arbitrary Javascript into a victim's browser through the affected parameters...

CVE-2019-15483

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log...

CVE-2019-15485

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

CVE-2019-15483

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log...

CVE-2019-15484

Bolt before 3.6.10 has XSS via an image's alt or title field...

CVE-2019-15484

Bolt before 3.6.10 has XSS via an image's alt or title field...

CVE-2019-15485

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

Cross site scripting

Bolt before 3.6.10 has XSS via an image's alt or title field...

Design/Logic Flaw

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

Design/Logic Flaw

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log...

CVE-2019-15485

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

CVE-2019-15484

Bolt before 3.6.10 has XSS via an image's alt or title field...

CVE-2019-15484

CVE-2019-15484 affects Bolt before 3.6.10 with an XSS via an image’s alt or title field. The root cause is tied to unsanitized image metadata in Bolt’s handling/rendering path. The connected documents note a fix in Bolt 3.6.10 (release/tag 3.6.10). Exploitation details are not provided in the sup...

CVE-2019-15483

CVE-2019-15483 affects Bolt CMS (Bolt) prior to version 3.6.10. The vulnerability is a cross-site scripting (XSS) flaw caused by mishandling a title in the system log, enabling an attacker to inject and execute client-side code under certain log-processing conditions. The issue is addressed in Bo...

CVE-2019-15483

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log...

Bolt CMS 3.6.6 - Cross-Site Request Forgery / Remote Code Execution Exploit

Exploit for php platform in category web applications history.pushState'', '', '/' function exploit var target = "http://127.0.0.1" var boltadminurl = target + "/bolt"; var xhr = new XMLHttpRequest; xhr.open"POST", boltadminurl + "/upload", true; xhr.setRequestHeader"Accept", "application/json,...

Bolt CMS Cross-Site Request Forgery Vulnerability

Bolt CMS is an open source content management system for the Bolt community. A cross-site request forgery vulnerability exists in the bolt/upload file upload feature in Bolt CMS version 3.6.6, which originates from a WEB application that does not adequately validate that a request is coming from ...

Bolt CMS 3.6.6 - Cross-Site Request Forgery Remote Code Execution

Bolt CMS 3.6.6 - Cross-Site Request Forgery Remote Code Execution history.pushState'', '', '/' function exploit var target = "http://127.0.0.1" var boltadminurl = target + "/bolt"; var xhr = new XMLHttpRequest; xhr.open"POST", boltadminurl + "/upload", true; xhr.setRequestHeader"Accept",...