Cross-site Scripting (XSS)

bolt/bolt is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary JavaScript through the URI field...

Cross-site Scripting (XSS)

Bolt CMS is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript by uploading a SVG file with Content-Type: image/svg+xml in it's header to the application when editing a page...

Cross-site Scripting (XSS)

Bolt CMS is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the user input, allowing a malicious user to inject and execute arbitrary javascript through the Title Field of a new entry...

Arbitrary Code Execution

Bolt is vulnerable to arbitrary code execution. The library does not properly check for file type during file uploads and the theme editor allows the renaming of file extentions. This allows a malicious user to inject and execute arbitrary PHP code by passing a php file saved with a different fil...

Bolt CMS Cross-Site Scripting Vulnerability

Bolt CM is an open source content management system developed by the Bolt community. A cross-site scripting vulnerability exists in Bolt CMS version 3.2.14. A remote attacker can use text input to inject arbitrary web script or HTML...

Bolt CMS Stored Cross-Site Scripting Vulnerability

Bolt CM is an open source content management system developed by the Bolt community. A security vulnerability exists in Bolt CMS version 3.2.14. A remote attacker can inject arbitrary web script or HTML by uploading an SVG document with 'Content-Type: image/svg+xml' header...

CVE-2017-11127

Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header...

CVE-2017-11128

Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry...

Cross site scripting

Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header...

Cross site scripting

Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry...

CVE-2017-11127

Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header...

CVE-2017-11128

Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry...

CVE-2017-11127

Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header...

CVE-2017-11127

Bolt CMS 3.2.14 is affected by a stored XSS via uploading an SVG document with Content-Type: image/svg+xml. The vulnerability stems from how Bolt handles SVG uploads, enabling arbitrary script execution in stored context. Affected component is Bolt CMS’s upload/SVG handling for page content. Impa...

CVE-2017-11128

CVE-2017-11128 affects Bolt CMS (notably version 3.2.14) and is caused by stored XSS via the Title field when creating a new entry. The vulnerability arises from unsanitized text input in a content title, enabling script execution in contexts where the title is displayed. Public references in the...

CVE-2017-11128

Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry...

PT-2017-11760 · Bolt · Bolt Cms

Name of the Vulnerable Software and Affected Versions: Bolt CMS version 3.2.14 Description: The issue allows for stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header. This can be exploited by uploading a malicious SVG file. Recommendations: For Bolt CMS version...

PT-2017-11761 · Bolt · Bolt Cms

Name of the Vulnerable Software and Affected Versions: Bolt CMS version 3.2.14 Description: The issue allows stored XSS via text input, as demonstrated by the Title field of a New Entry. This can be exploited by injecting malicious code into the text input fields. Recommendations: For Bolt CMS...

shopping.barnhillbolt.com XSS vulnerability

Vulnerable URL: http://shopping.barnhillbolt.com/itDetail.asp?it=1"...

suburbanbolt.com XSS vulnerability

Vulnerable URL: https://www.suburbanbolt.com/catalogbigimage.asp?img=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 09:45 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alex...