https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 11:01:08 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-35955 cnvd-2020-35955 https://cve.radiocsirt.org/vuln/cnvd-2020-35955 https://cve.radiocsirt.org/vuln/euvd-2026-36351 EUVD-2026-36351 https://cve.radiocsirt.org/vuln/euvd-2026-36351 https://cve.radiocsirt.org/vuln/fkie_cve-2020-4041 <p>In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.</p> <p>In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-4041 https://cve.radiocsirt.org/vuln/ghsa-68q3-7wjp-7q3j <p><strong>Affected:</strong> Packagist: bolt/bolt</p> <p>### Impact</p> <p>The filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it.</p> <p>Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented.</p> <p>### Patches</p> <p>This is fixed in Bolt 3.7.1.</p> <p>### References</p> <p>Related issue: https://github.com/bolt/bolt/pull/7853</p> <p><strong>Affected:</strong> Packagist: bolt/bolt</p> <p>### Impact</p> <p>The filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it.</p> <p>Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented.</p> <p>### Patches</p> <p>This is fixed in Bolt 3.7.1.</p> <p>### References</p> <p>Related issue: https://github.com/bolt/bolt/pull/7853</p> https://cve.radiocsirt.org/vuln/ghsa-68q3-7wjp-7q3j https://cve.radiocsirt.org/vuln/gsd-2020-4041 gsd-2020-4041 https://cve.radiocsirt.org/vuln/gsd-2020-4041 https://cve.radiocsirt.org/vuln/msrc_cve-2020-4041 msrc_CVE-2020-4041 https://cve.radiocsirt.org/vuln/msrc_cve-2020-4041