Vulnerabilities > Boltcms

DATE CVE VULNERABILITY TITLE RISK
2017-11-10 CVE-2017-16754 Incorrect Permission Assignment for Critical Resource vulnerability in Boltcms Bolt
Bolt before 3.3.6 does not properly restrict access to _profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php.
network
low complexity
boltcms CWE-732
5.0
2015-09-22 CVE-2015-7309 Injection vulnerability in Boltcms Bolt
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
network
low complexity
boltcms CWE-74
6.5