medium6.5
CVE-2026-39229
Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages.
Impact
Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated attacker with low-level privileges can exploit this through the OrderDirective component. This allows for the extraction of sensitive information
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bolt CMS | Bolt CMS | through 3.7.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.