First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2019-9553

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://packetstormsecurity.com/files/151943/Bold-CMS-3.6.4-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46495Exploit, Third Party Advisory, VDB Entry
https://packetstormsecurity.com/files/151943/Bold-CMS-3.6.4-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46495Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Dec 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-95546.1In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/CVE-2019-95555.3Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of kn CVE-2019-95565.4FiberHome an5506-04-f RP2669 devices have XSS.CVE-2019-95576.1Ability Mail Server 4.2.6 has Persistent Cross Site Scripting (XSS) via the body e-mail body. To exploit the vulnerability, the victim must CVE-2019-95586.1Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message. To exploit the vulnerabili CVE-2019-95637.5In BlueMind 3.5.x before 3.5.11 Hotfix 7 and 4.x before 4.0-beta3, the contact application mishandles temporary uploads.CVE-2019-95649.8A vulnerability in the authentication logic of Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to bypass login and control the devices. T CVE-2019-95659.1Druide Antidote RX, HD, 8 before 8.05.2287, 9 before 9.5.3937 and 10 before 10.1.2147 allows remote attackers to steal NTLM hashes or perfor CVE-2019-95669.8FlarumChina v0.1.0-beta.7C has SQL injection via a /?q= request.CVE-2019-95676.1The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.CVE-2019-95686.5The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=formina CVE-2019-95699.8Buffer Overflow in dactetra in Delta Controls enteliBUS Manager V3.40_B-571848 allows remote unauthenticated users to execute arbitrary code