Vulnerability Database

313,825

Total vulnerabilities in the database

CVE-2019-10874

Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file.

  • Published: Apr 5, 2019
  • Updated: Nov 9, 2025
  • CVE: CVE-2019-10874
  • Severity: Medium
  • Exploit:

CVSS v2:

  • Severity: Medium
  • Score: 6.8
  • AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
boltcms / bolt 3.6.6 3.6.6.x